dependency-audit

Dependency Audit — Framework, Package, and Toolchain Security

Audit project dependencies, frameworks, language runtimes, and dev tools for known vulnerabilities (CVEs), security anti-patterns, and supply chain risks.

Cross-references: patch-sweep for patching the same advisory across many repos; scanner-pipeline for running osv-scanner / trivy in CI across every lockfile at once; agent-supply-chain-audit for reviewing the content of MCP servers, skills, and plugins this skill inventories; cloud-audit "PaaS" for platform runtime and config checks behind Mitigated (platform/config); secrets-audit for tokens found in .npmrc or CI; iam-audit for the cloud roles CI assumes via OIDC; cicd-security for workflow and runner security; finding-triage for dispositioning individual findings.

Authorization

Confirm the user owns or is authorized to audit the repo, CI system, and registries before running anything. Audit tools are read-only, but fix commands (audit fix, bundle update) rewrite lockfiles. Run them only when asked, on a branch, never on the production branch directly.

Methodology

Step 0: Confirm What Ships

Before inventorying anything, confirm you are auditing the code that is actually deployed:

• Production branch: the branch the platform or deploy workflow builds from (Vercel/Netlify production branch, Heroku pipeline, on: push: branches: in the deploy workflow). It is not always main. In one field sweep, main held only a README.
• Monorepos: which app or package is deployed, and its lockfile or workspace slice.
• Package manager: which lockfile is committed and the packageManager field. This decides the audit command in Step 2.