Dependency Vulnerability Check
Check NuGet and npm dependencies for known vulnerabilities.
What To Do
.NET dependencies:
dotnet list package --vulnerable --include-transitive dotnet list package --outdatednpm dependencies:
npm audit --json > npm-audit.json npm audit fixConfigure Dependabot (.github/dependabot.yml):
version: 2 updates: - package-ecosystem: "nuget" directory: "/src/backend" schedule: { interval: "weekly" } - package-ecosystem: "npm" directory: "/src/frontend" schedule: { interval: "weekly" }Update specific package:
dotnet add package PackageName --version X.Y.Z
Arguments
--ecosystem=<type>: nuget or npm--auto-merge: Auto-merge minor/patch updates