dependency-audit

Dependency Audit

Scan project dependencies, detect security vulnerabilities, outdated packages, and license compliance issues.

Overview

Comprehensively audit project dependencies: CVE vulnerability scanning, outdated dependency detection, license compliance checking, and duplicate dependency analysis. Output a security report sorted by severity and executable fix commands.

When to Use

• User wants to check dependency security
• User mentions CVE, vulnerability, or audit
• User wants to know outdated dependencies
• User says "审计依赖" / "check dependencies"
• User inputs /dependency-audit

When NOT to Use:

• User only wants to update versions
• User wants code-level security review
• User wants to analyze runtime dependencies
• User wants deep license analysis
• User wants to scan Docker images

Core Pattern

Step 1: Detect package manager

Detection file	Package manager	Audit command
package-lock.json	npm	npm audit
yarn.lock	yarn	yarn audit
pnpm-lock.yaml	pnpm	pnpm audit
go.sum	Go	govulncheck ./...
requirements.txt / Pipfile.lock	Python	pip-audit
Cargo.lock	Rust	cargo audit

Step 2: Vulnerability scanning

# 工具可用性检查（所有步骤共用）
check_tool() {
  command -v "$1" >/dev/null 2>&1 || { echo "⚠️ $1 未安装，跳过 $2 审计"; return 1; }
}

Core commands (execute separately per package manager, automatically skip missing tools):

⚠️ npm audit Exits with a non-zero code when vulnerabilities are found — do not use if npm audit ...; then to determine success, directly parse the --json output:

Package manager	Audit command
npm	npm audit --json | jq '.metadata.vulnerabilities.total' → parse vulnerabilities count + severity (do not rely on exit code)
Go	govulncheck ./... → install golang.org/x/vuln/cmd/govulncheck@latest
Python	pip-audit → install: pip install pip-audit

Output: total vulnerability count + CVE list categorized by severity (critical/high/medium/low).

Step 3: Outdated dependency detection

Core commands (execute separately per package manager, automatically skip missing tools):

Package manager	Detection command
npm	npx npm-check-updates --format table
Go	go list -m -u all | grep "\["
Python	pip list --outdated

Statistics: number of outdated dependencies, major/minor/patch upgrade distribution, and whether there are security-related updates.

Step 4: License compliance check

Core commands (execute separately per package manager):

Package manager	Detection command
npm	npx license-checker --json → count by license type
Go	go-licenses csv ./... → install: go install github.com/google/go-licenses@latest

Detection focus: copyleft licenses such as GPL/AGPL, unknown/custom licenses, license compatibility.

Step 5: Generate report

Use the templates/audit-report.md template, output:

1. Security overview — vulnerability count and severity distribution
2. High-risk vulnerabilities — CVEs that need immediate fixing
3. Outdated dependencies — sorted by upgrade difficulty
4. License compliance — list of risky licenses
5. Fix commands — each issue comes with an executable command

Quick Reference

/dependency-audit                    # 完整审计
/dependency-audit --security         # 只检查安全漏洞
/dependency-audit --licenses         # 只检查 license
/dependency-audit --fix              # 自动修复可安全升级的依赖

Parameter	Description	Default value
--security	Only check security vulnerabilities	false
--licenses	Only check license compliance	false
--fix	Auto fix	false

Common Mistakes

Mistake	Correct approach	Reason
Only look at high/critical	medium also needs attention	Many attack chains escalate from medium
Blindly upgrade all dependencies	Upgrade and test one by one	major upgrades may have breaking changes
Do not check transitive dependencies	Analyze the complete dependency tree	Vulnerabilities often occur in indirect dependencies
Ignore license compliance	Check licenses regularly	GPL contagion risk
Do not update the lock file after audit	Regenerate the lock file	Ensure the fix takes effect
Ignore deprecated dependencies	Check deprecation warnings	Deprecated packages may have security risks