/dependency-audit

Audit project dependencies for known vulnerabilities and outdated packages.

Steps

1. Detect the package manager and run the native audit command:

• npm: `npm audit --json`
• pnpm: `pnpm audit --json`
• yarn: `yarn audit --json`
• pip: `pip-audit --format json` or `safety check --json`
• cargo: `cargo audit --json`
• go: `govulncheck ./...`

2. Parse audit results and categorize by severity (critical, high, moderate, low). 3. For each vulnerability:

• Identify the affected package and version range.
• Check if a patched version is available.
• Determine if it is a direct or transitive dependency.
• Assess actual exploitability in the project context.

4. Check for outdated dependencies: `npm outdated`, `pip list --outdated`. 5. Generate an upgrade plan prioritized by:

• Critical vulnerabilities first.
• Direct dependencies over transitive.
• Minimal version bumps (patch > minor > major).

6. Test compatibility of recommended upgrades if possible. 7. Offer to apply safe upgrades automatically.

Format

Dependency Audit Report
=======================

Vulnerabilities: <critical>C / <high>H / <moderate>M / <low>L

| Package | Current | Patched | Severity | Type | CVE |
|---------|---------|---------|----------|------|-----|

Outdated (no vulnerabilities):
| Package | Current | Latest | Type |
|---------|---------|--------|------|

Recommended actions:
1. <action with command>

Rules

• Always distinguish between direct and transitive dependencies.
• Do not auto-upgrade major versions without user confirmation.
• Report vulnerabilities even if no fix is available yet.
• Check that lock files are committed and up to date.
• Verify upgrades do not break the test suite before recommending them.