dependency-scan

Dependency scanning identifies known CVEs, outdated packages, and security risks across your project's dependencies. The skill parses manifests and dependency trees to detect vulnerabilities in direct and transitive dependencies, then recommends patches and upgrade paths to remediate them.

Dependency scanning covers Node.js, Python, Rust, Go, Ruby, Java/Maven, .NET, and PHP ecosystems. It distinguishes direct from transitive dependencies and identifies phantom dependencies, providing comprehensive vulnerability assessment across multiple languages and package managers.

Yes, dependency scanning flags license compliance issues alongside vulnerabilities. It assesses all dependencies for licensing concerns and provides upgrade guidance to help you maintain compliance across your project's entire dependency tree.

Dependency scanning generates a complete Software Bill of Materials (SBOM) and produces actionable upgrade paths for high-risk packages. The output includes remediation guidance and exploitability assessment to guide your patching strategy.

Yes, dependency scanning explicitly differentiates direct dependencies you explicitly require from transitive dependencies pulled in by your direct dependencies. This distinction helps prioritize remediation efforts on vulnerabilities in your direct supply chain.