dependency-audit

Install pip-audit and run it against your requirements file or installed environment to list known CVEs. Triage each hit by checking whether the vulnerable code path is actually reachable in your application before prioritizing patches.

Run npm audit --omit=dev to scan production dependencies for known vulnerabilities. For deeper coverage including containers, use trivy against your filesystem or built images filtered to HIGH and CRITICAL severities.

Verify the exact package name against official docs to avoid typosquats, confirm the package is actively maintained, inspect install scripts for surprising behavior, and measure transitive cost with npm ls or pipdeptree.

Use npm overrides or a pip constraint pin to force the patched version of the transitive package, then verify the dependency tree resolved correctly. After deploying, check logs for exploitation signatures since the CVE disclosure date.

npm install can resolve version ranges differently than your lockfile, meaning a hijacked release could slip into a deploy. Use npm ci in CI so installs are reproducible from the committed lockfile.

Patch today when a Critical vulnerability is reachable in your code and exposed in your deployment. Everything else should get a dated ticket with documented reasoning rather than being ignored.