dependency-triage

To scan package manifests and lockfiles for vulnerable dependencies, this Skill automates the detection of outdated packages and security risks, classifying updates by severity and type to maintain secure software dependencies.

The best way to automate dependency updates and vulnerability scanning is using a Skill that evaluates lockfiles, categorizes updates by Patch, Minor, Major, or CVE severity, and outputs a prioritized list to a state file.

Dependency classification by severity works by scanning package manifests and lockfiles, evaluating outdated or vulnerable packages, and sorting required updates into categories like Patch, Minor, Major, and CVE for prioritized management.

Yes, you can manage software security updates in a state file. This Skill generates and updates a state file with a prioritized list of required dependency updates based on lockfile vulnerability assessments.

Yes, this dependency scanning tool works without external dependencies. It operates independently using internal scripts to evaluate package manifests and lockfiles for outdated and vulnerable software components.

You need to run vulnerability assessments on package lockfiles regularly during development to identify outdated dependencies, classify update severities, and prevent security issues from accumulating in your codebase.