dependency-audit

To audit project dependencies for security vulnerabilities and license compliance, this tool analyzes package manifests and lockfiles across Python, Node, Rust, Go, and mixed-language projects. It maps dependencies to CVEs, classifies severities, and detects copyleft or unknown licenses to generate prioritized remediation reports.

Yes, you can detect unused and duplicate dependencies in a Node.js or Python project by scanning import statements and analyzing transitive-impact trees. The tool identifies bloat candidates by finding unused packages, duplicate functionality, and heavy transitive trees with size and import-evidence metrics.

The best way to check transitive dependency trees for abandoned packages is to compute maintenance health scores using release cadence, commit activity, CI status, and bus factor signals. This evaluates the entire dependency graph to surface maintenance health risks and flag abandoned packages.

Yes, the dependency audit works with mixed-language repositories by analyzing package manifests and lockfiles across Python, Node, Rust, and Go. It processes both direct and transitive dependency trees simultaneously to evaluate license compatibility, detect CVEs, and identify bloat across all detected languages.

You evaluate license compatibility risks for copyleft transitive dependencies by analyzing the full dependency graph to detect copyleft, unknown, or commercial-incompatible licenses. The audit surfaces transitive license risks and generates prioritized remediation steps to ensure compliance.

Limitations of dependency bloat detection through import scanning include reliance on static import evidence and package manifests, which may miss dynamically loaded packages. Bloat detection focuses on finding unused packages and duplicate functionality by analyzing transitive-impact trees within Python, Node, Rust, and Go projects.