dep-audit

To audit project dependencies for known vulnerabilities, you run a pre-ship check that analyzes manifests and lockfiles against ecosystem security databases. This process ranks findings by severity and reachability so you can prioritize and fix the most critical risks before shipping.

The safest way to upgrade an outdated package is to apply the smallest patch or minor update that clears the vulnerability. This safe upgrade planning avoids unnecessary breaking changes by verifying compatibility and running build and test loops before finalizing the update.

Dependency auditing works with npm, pnpm, yarn, Python, PHP, Ruby, and Go ecosystems. It requires access to the specific ecosystem's audit and outdated commands, along with manifest and lockfile access, to accurately detect vulnerable packages across these platforms.

To check for risky licenses in your project dependencies, you run an audit that analyzes your manifests and lockfiles. This identifies stale packages and risky licenses that code review alone can miss, allowing you to document any accepted risk before release.

Vulnerable transitive packages are found during a pre-ship check by analyzing the lockfile to map the full dependency tree. The audit prioritizes findings by severity and reachability, helping maintainers catch hidden transitive risks that manual code review misses.

You should run build and test verification after updating a lockfile to confirm the upgrade is actually safe. This verification loop ensures the recommended patch or minor update clears the vulnerability without introducing unexpected breaking changes to the project.