dependency-audit

To audit JavaScript dependencies for security vulnerabilities, you can run a comprehensive scan using npm, pnpm, or yarn. This process identifies CVEs and GHSA issues, prioritizes them by severity, and provides actionable recommendations to fix or automatically patch vulnerable packages.

Checking npm and pnpm packages for outdated versions and license compliance involves running a full project audit. This process evaluates your dependencies against current vulnerability databases, categorizes outdated packages by major, minor, or patch updates, and flags any license compliance issues.

Yes, dependency auditing works with yarn, npm, and pnpm package managers. The auditing process requires access to your package manager commands and vulnerability databases to accurately scan JavaScript and TypeScript projects for security issues and outdated packages.

You can automatically patch vulnerable dependencies during a security audit by applying automated patching for safe updates. The audit identifies critical vulnerabilities and provides automated patching specifically for safe minor and patch dependency updates to secure your release.

You should run a full dependency audit before releasing a new application version to identify any critical vulnerabilities and automatically update minor and patch dependencies. This ensures a secure, stable release by resolving issues proactively.