dep-audit

Run the audit command matching your package manager, such as npm audit for Node.js, pip-audit for Python, or cargo audit for Rust. The Skill detects your lock file automatically, runs the right tool, and classifies each vulnerability by severity with a recommended fix.

Use npm outdated to list packages behind their latest versions, then apply patch updates immediately since they are safe. For minor upgrades check the changelog, and for major upgrades review breaking changes before updating, since code changes may be required.

npm audit reports known security vulnerabilities in installed packages, while npm outdated only shows packages behind their latest published version. A package can be outdated without being vulnerable, so both checks are needed for a complete dependency review.

Audits are less reliable without a lock file because the exact installed dependency tree cannot be determined. The Skill notes this limitation when no lock file exists, since vulnerability results may not reflect what is actually installed.

Avoid major upgrades when the changelog indicates breaking API changes that your code depends on, or when the package is loaded through dynamic imports that static analysis might miss. Plan these upgrades separately with testing rather than bundling them with patch updates.