agulli Process
Identify the package manager. Look for:
requirements.txt/pyproject.toml/Pipfile→ Python (pip/uv)package.json→ Node.js (npm/yarn/pnpm)go.mod→ GoCargo.toml→ Rust
Run vulnerability scan.
- Python:
pip auditoruvx pip-audit - Node.js:
npm auditornpx better-npm-audit audit - Go:
govulncheck ./...
- Python:
Check for outdated packages.
- Python:
pip list --outdated - Node.js:
npm outdated
- Python:
License audit. Check that no dependency uses a copyleft license (GPL, AGPL) in a proprietary project:
- Python:
uvx pip-licenses --order=license - Node.js:
npx license-checker --summary
- Python:
Identify unused dependencies.
- Python: Check each import with
grep -r "import <package>" src/ - Node.js:
npx depcheck
- Python: Check each import with
Write the report as a markdown table with columns: Package, Current Version, Latest Version, Vulnerabilities, License, Status (keep/update/remove).
Rationalizations
| Excuse | Rebuttal |
|---|---|
| "We'll update dependencies later" | Known vulnerabilities are actively exploited. Flag them now. |
| "It's a dev dependency, it doesn't matter" | Dev dependencies run in CI and on developer machines — they are attack surface. |
| "Removing unused deps might break something" | If nothing imports it, nothing uses it. Remove it. |
Verification
- Vulnerability scan was executed (not estimated)
- Every critical/high vulnerability has a recommended action (update version or replace package)
- License compatibility was checked against the project's license