package-audit

You can audit npm dependencies for security vulnerabilities using automated vulnerability scanning to detect known CVEs. This skill scans project dependencies via npm, yarn, or pnpm, integrating with Snyk and Socket for comprehensive security analysis and structured update strategies.

The best way to triage outdated packages is to identify newer versions and categorize update strategies into patch, minor, or major updates. This skill generates an actionable update planning report to systematically manage dependency updates across your project.

Yes, this dependency audit tool supports yarn and pnpm package managers alongside npm. It automates vulnerability scanning, outdated package triage, and license compliance reporting across all three package management ecosystems.

To check package license compliance, you verify that dependency licenses comply with your project policy. This skill generates structured license compliance reports covering both production and development dependencies to prevent policy violations.

You should run a vulnerability scan and dependency audit before merging a pull request to ensure no new security vulnerabilities or license violations are introduced. This prevents vulnerable or non-compliant dependencies from entering your production codebase.

Yes, you can integrate Snyk or Socket for comprehensive vulnerability scanning. This skill works with both tools to deeply analyze project dependencies, detect known CVEs, and provide structured update strategies for your package management workflow.