Dep Audit

Dependency Audit

Cross-repository dependency audit. Scans package manifests (package.json, pyproject.toml, Cargo.toml, go.mod) for outdated packages, security advisories, version conflicts between repos, and license compatibility issues. Produces a prioritized update plan.

Install

git clone https://github.com/thatrebeccarae/claude-marketing.git && cp -r claude-marketing/skills/dep-audit ~/.claude/skills/

When to Use

• Monthly hygiene: Run on a cadence to catch dependency drift before it compounds
• Before releases: Verify no known vulnerabilities ship to production
• Security incidents: When a CVE drops, quickly assess exposure across all repos
• Onboarding new repos: Baseline the dependency health of a repo you're inheriting or adopting

Usage

• /dep-audit [repo-path] — audit a single repository
• /dep-audit [repo-path1] [repo-path2] ... — cross-repo audit (enables version conflict detection)

Procedure

1. Detect Package Managers

Scan the target repo(s) for manifest files:

# Detect which manifests exist
ls package.json pyproject.toml Cargo.toml go.mod requirements.txt 2>/dev/null
# Detect lock files
ls package-lock.json yarn.lock pnpm-lock.yaml poetry.lock uv.lock Cargo.lock go.sum 2>/dev/null

If multiple ecosystems are present (e.g., a monorepo with Node.js frontend and Go backend), audit each independently and merge results.

2. Parse Manifests and Lock Files

Read the manifest to identify declared dependencies (direct) and the lock file for resolved versions (transitive). Distinguish between:

• Production dependencies (dependencies, [dependencies], main requires)
• Development dependencies (devDependencies, [dev-dependencies], extras)

3. Check for Outdated Packages

Query the registry for latest versions and categorize the delta:

# Node.js
npm outdated --json

# Python (pip)
pip list --outdated --format=json

# Python (poetry)
poetry show --outdated

# Rust
cargo outdated --format json  # requires cargo-outdated

# Go
go list -m -u all

Categorize each outdated package:

• Patch update (e.g., 2.3.1 -> 2.3.4): Safe, usually bug fixes
• Minor update (e.g., 2.3.1 -> 2.5.0): New features, should be backward-compatible
• Major update (e.g., 2.3.1 -> 3.0.0): Breaking changes likely, needs migration review

4. Check for Security Advisories

Run ecosystem-native audit tools:

# Node.js
npm audit --json

# Python
pip-audit --format=json  # or: safety check

# Rust
cargo audit --json  # requires cargo-audit

# Go
govulncheck ./...

Parse severity from results:

• Critical: Remote code execution, authentication bypass, data exfiltration
• High: Privilege escalation, significant data exposure
• Medium: DoS potential, limited data exposure
• Low: Information disclosure, minor issues

5. Cross-Repo Analysis (Multiple Repos)

When auditing two or more repos, compare dependency versions:

• Version conflicts: Same package at different versions across repos (e.g., axios@0.27.2 in repo A, axios@1.6.2 in repo B)
• Shared dependencies: Packages used by multiple repos that could be aligned to a single version
• Divergent major versions: Flag these as highest priority — they indicate repos drifting apart

Present a conflict table showing package, version per repo, and recommended target version.

6. License Scan

Check dependency licenses against compatibility rules:

# Node.js
npx license-checker --json

# Python
pip-licenses --format=json

# Rust
cargo license --json  # requires cargo-license

# Go
go-licenses report ./...  # requires go-licenses

Flag issues:

• Copyleft in permissive projects: GPL/AGPL dependencies in MIT/Apache-licensed projects
• Unknown or missing licenses: Dependencies with no license metadata
• Non-OSI-approved licenses: Custom or restrictive licenses
• License conflicts: Incompatible license combinations (e.g., GPLv2-only with Apache-2.0)

7. Generate Update Plan

Prioritize all findings into a single ordered list:

1. Critical security advisories — fix immediately 2. High security advisories — fix this sprint 3. License violations — assess and remediate 4. Major outdated (with known issues) — plan migration 5. Cross-repo version conflicts — align versions 6. Minor outdated — batch update 7. Patch outdated — batch update

Group related updates together:

• All @types/* packages in one PR
• All packages from the same org (e.g., @babel/*)
• Peer dependency chains that must move together

Note breaking change risks for any major update. Link to migration guides where available.

8. Report

Produce a severity-coded summary table:

Follow with:

• Total dependency count (direct / transitive) per repo
• Security summary: X critical, Y high, Z medium, W low
• Outdated summary: X major, Y minor, Z patch
• License summary: X flagged, Y clean
• Cross-repo conflicts: X packages with version divergence

Key Principles

1. Never auto-update. This skill audits and recommends. The human decides what to update and when. Automated updates can introduce breaking changes, especially for major versions. 2. Security first. Critical and high-severity vulnerabilities always top the priority list, regardless of how old other dependencies are. 3. Group related updates. Updating react without updating react-dom creates version mismatches. Always identify peer dependency chains. 4. Context matters. A major version bump on a dev-only dependency (e.g., eslint) is lower risk than a patch on a production runtime dependency with a CVE. 5. Lock files are truth. Always read the lock file for actual resolved versions, not just the range specifier in the manifest. 6. Don't chase latest for its own sake. If a dependency is working, stable, and has no advisories, "outdated" is not the same as "broken."

How to Use This Skill

Ask:

• "Audit the dependencies in ~/Repos/my-app"
• "Compare dependency versions across these three repos"
• "Are there any security vulnerabilities in this project?"
• "Check for license issues before we open-source this repo"
• "Build me an update plan for everything that's behind"

For command reference, license compatibility details, and false positive handling, see REFERENCE.md. For worked examples, see EXAMPLES.md.

Dependency Audit — Examples

1. Single Node.js Repo — Outdated Dependencies

User Request:

/dep-audit ~/Repos/my-saas-app

Detection:

• Package manager: npm (found package.json + package-lock.json)
• 42 direct dependencies (34 production, 8 dev)
• 318 resolved packages in lock file

Outdated Packages:

Security Audit (npm audit):

License Scan: All clear. 318 packages, all MIT/Apache-2.0/ISC/BSD.

Update Plan:

---

2. Cross-Repo Audit — Version Conflicts

User Request:

/dep-audit ~/Repos/api-service ~/Repos/worker-service ~/Repos/shared-lib

Detection:

• api-service: npm (package.json + package-lock.json) — 56 direct deps
• worker-service: npm (package.json + package-lock.json) — 38 direct deps
• shared-lib: npm (package.json + package-lock.json) — 12 direct deps

Cross-Repo Version Conflicts:

Key Findings:

• shared-lib on TypeScript 4.9.5 while both services are on 5.x. This blocks adoption of TS 5 features (decorators, satisfies) in shared code. High priority to align.
• lodash 4.17.19 in shared-lib has a known prototype pollution CVE (CVE-2021-23337) fixed in 4.17.21. Critical fix.
• Prisma version divergence between api-service and worker-service means schema changes tested against one version may break on the other.

Update Plan:

Recommendation: Consider a monorepo or shared workspace config (npm workspaces, Turborepo) to enforce single versions of shared dependencies across these three repos.

---

3. Security Advisory — Prioritized Response

User Request:

"A critical CVE just dropped for next (Next.js). Run /dep-audit on all our frontend repos to assess exposure."

>

/dep-audit ~/Repos/marketing-site ~/Repos/customer-portal ~/Repos/admin-dashboard

Detection:

CVE-2025-29927 Details:

• Severity: Critical (CVSS 9.1)
• Vector: Attackers can bypass middleware.ts authorization by sending a crafted x-middleware-subrequest header
• Impact: Complete auth bypass on any route protected by Next.js middleware
• Fix: Upgrade to Next.js >= 14.2.15 (14.x) or >= 13.5.9 (13.x)

Prioritized Response Plan:

Immediate Mitigation (if upgrade cannot be deployed within hours):

# Block the attack vector at the reverse proxy / CDN level
# Add a rule to strip or reject requests with the x-middleware-subrequest header
# Example for nginx:
#   proxy_set_header x-middleware-subrequest "";
# Example for Cloudflare WAF:
#   Block requests where http.request.headers["x-middleware-subrequest"] exists

Post-Incident:

• Set up Dependabot or Renovate on all three repos for automated security PRs
• Add npm audit --audit-level=high to CI pipeline to catch future advisories before merge
• Schedule quarterly dependency audit cadence using this skill

Dependency Audit Reference

Package Manager Commands

Checking Outdated Packages

Security Audit Commands

License Checking Commands

Lock File Locations

Common License Types and Compatibility

Permissive Licenses (low restriction)

Copyleft Licenses (viral, higher restriction)

Compatibility Matrix (can A include B?)

\ LGPL is OK if the dependency is dynamically linked (standard for most package managers). \* Apache-2.0 has patent clauses incompatible with GPL-2.0-only (but compatible with GPL-2.0-or-later and GPL-3.0).

Licenses to Flag

• AGPL-3.0: Network copyleft. If you use it in a SaaS product, your entire codebase must be AGPL. Almost always a blocker for proprietary projects.
• GPL-2.0 / GPL-3.0: Copyleft. If you distribute the software, derivative works must use the same license.
• SSPL: MongoDB's Server Side Public License. Not OSI-approved. Treat as proprietary-restrictive.
• BSL: Business Source License. Time-delayed open source. Restrictions during the change period.
• No license / UNLICENSED: No license means all rights reserved by default. Cannot legally use.
• Custom / Unknown: Requires manual legal review.

Severity Scoring Criteria

Security Advisories

Outdated Packages (no advisory)

Dependabot vs Renovate

For automating dependency updates after the initial audit:

Recommendation: Renovate for repos that need grouped PRs, complex schedules, or monorepo support. Dependabot for simple repos that want zero config on GitHub.

Common False Positives

npm audit

pip-audit / safety

cargo audit

govulncheck

Useful One-Liners

# Count total direct dependencies (Node.js)
jq '.dependencies | length' package.json

# Count total resolved packages (Node.js)
jq '.packages | length' package-lock.json

# List all direct deps with versions (Python/poetry)
grep -A1 '^\[tool.poetry.dependencies\]' pyproject.toml

# Find duplicate packages at different versions (Node.js)
npm ls --all 2>/dev/null | grep 'deduped' | wc -l

# Show dependency tree for a specific package
npm ls <package-name>
cargo tree -p <crate-name>
go mod graph | grep <module-name>

# Check if a specific CVE affects you (npm)
npm audit --json | jq '.vulnerabilities | to_entries[] | select(.value.via[].url | test("CVE-XXXX-XXXXX"))'