Dep Audit

Dependency Audit

Request: $ARGUMENTS

Context

• Root package.json: !cat /Users/danilo/www/vida/package.json | node -p "const p=JSON.parse(require('fs').readFileSync('/dev/stdin','utf8')); JSON.stringify({...p.dependencies,...p.devDependencies}, null, 2)"
• Frontend deps: !node -p "const p=require('/Users/danilo/www/vida/frontend/package.json'); JSON.stringify({...p.dependencies,...p.devDependencies}, null, 2)"
• Backend deps: !node -p "const p=require('/Users/danilo/www/vida/backend/package.json'); JSON.stringify({...p.dependencies,...p.devDependencies}, null, 2)"

Your task

Step 1 — Check for outdated packages

cd /Users/danilo/www/vida && npm outdated --json 2>/dev/null
cd /Users/danilo/www/vida/frontend && npm outdated --json 2>/dev/null
cd /Users/danilo/www/vida/backend && npm outdated --json 2>/dev/null

Step 2 — Security audit

cd /Users/danilo/www/vida && npm audit --json 2>/dev/null
cd /Users/danilo/www/vida/frontend && npm audit --json 2>/dev/null
cd /Users/danilo/www/vida/backend && npm audit --json 2>/dev/null

Step 3 — Report

Produce a table grouped by severity:

Security vulnerabilities:

Outdated packages:

Categorize each update as:

• patch — safe to update immediately
• minor — review changelog, likely safe
• major — breaking changes, requires careful upgrade

Step 4 — Auto-fix (if --fix passed)

If $ARGUMENTS contains --fix, apply safe patch and minor updates:

cd /Users/danilo/www/vida/frontend && npm update
cd /Users/danilo/www/vida/backend && npm update

Then re-run npm run check && npm run test for both to verify nothing broke.

Step 5 — Summary

Security: X critical, X high, X moderate, X low
Outdated: X packages across 3 workspaces
  X patch updates (safe to apply now)
  X minor updates (review changelog)
  X major updates (require planning)

For critical/high vulnerabilities, open a GitHub issue using mcp__github__issue_write with label infra.