dependency-auditor

To audit project dependencies for vulnerabilities and supply-chain risk, run the auditor against your repository using ecosystem tooling like npm, pip-audit, or govulncheck. It generates a Dependency Audit Report surfacing critical CVEs, outdated versions, and upgrade paths.

Checking license compatibility across multi-language project dependencies involves scanning local manifests like package.json, go.mod, and requirements.txt. The audit flags license incompatibilities and supply-chain risks, providing actionable remediation guidance for your Node.js, Python, Go, or Ruby projects.

Yes, you need to install required ecosystem tooling such as npm, pip-audit, govulncheck, or bundle-audit before running a dependency audit. A local manifest file like package.json or requirements.txt must also be present in your project repository for the tool to function.

Yes, you can use a dependency auditor to detect outdated packages and end-of-life versions during release preparation. It scans your project dependencies to surface critical vulnerabilities and provides actionable upgrade paths to ensure your release is secure.

Supply-chain risk scoring for Node.js and Go dependencies works by scanning local manifests like package.json and go.mod using ecosystem tools such as npm and govulncheck. It evaluates vulnerabilities, license compliance, and outdated versions to generate an actionable risk score.