Frontend Review — Dependencies
You are auditing the dependency health of a frontend project. This covers three areas:
- Freshness — outdated packages and breaking update procedures
- CVE triage — vulnerabilities weighted by actual attack vector, not just CVSS score
- Trend watch — deprecated, abandoned, or superseded libraries that should be migrated
Procedure
- In parallel, run:
scripts/audit-deps.sh --repo <client-repo>scripts/audit-trend-watch.sh --repo <client-repo>
- Read
raw/deps.json and raw/trend-watch.json.
- For each CVE finding, apply the attack-vector triage matrix below before assigning priority.
- For each trend-watch finding (Tier 1/2/3), confirm the installed version and assess migration cost.
CVE Triage — Attack Vector Matrix
Do not use CVSS score alone. A CVSS 9.8 RCE in a devDependency has zero production impact for a browser-only SPA.
| CVE Type |
devDep only |
Runtime (SPA) |
Runtime (SSR/Edge) |
| RCE |
ignore |
ignore |
P0 |
| Prototype Pollution |
ignore |
P1 (check input path) |
P0 |
| ReDoS |
ignore |
P1 (check user input reach) |
P0 |
| Path Traversal |
ignore |
ignore |
P0 |
| XSS via library |
ignore |
P0 (HTML-generating libs) |
P0 |
| SSRF |
ignore |
ignore |
P0 |
| Supply Chain (postinstall malware) |
CI P0 |
CI P0 |
P0 |
Triage procedure:
- Run
pnpm audit --prod to exclude devDeps from output.
- Focus on Prototype Pollution / ReDoS / XSS — other types are low-risk for browser-only SPAs.
- For each remaining finding, check whether user-controlled input can reach the vulnerable code path. If not, downgrade to P2.
- For SSR / Edge Functions, treat RCE / Path Traversal / SSRF as P0.
- Document every ignored CVE in
kpi/audit-triage.md with the reason.
# Runtime-only CVEs (excludes devDeps)
pnpm audit --prod --audit-level=moderate --json | jq '
.vulnerabilities | to_entries[] |
{ name: .key, severity: .value.severity,
via: [.value.via[] | select(type=="object") | .title] }'
# Prototype Pollution / ReDoS only
pnpm audit --prod --json 2>/dev/null | jq -r '
.vulnerabilities | to_entries[] |
.value.via[] | select(type=="object") |
select(.title | test("prototype|pollution|redos|regex denial"; "i")) |
"\(.severity) \(.title) in \(.name)"' | sort -u
Trend Watch — Library Tiers
Cross-references package.json against data/trend-watch-config.json:
- Tier 1 (migrate now): Deprecated / abandoned / superseded — no rational reason to continue. Includes libraries where migration cost is low and a mature alternative exists, even if not officially deprecated (
jest → vitest, axios → ky/fetch, cypress → Playwright).
- Tier 2 (plan migration): Maintenance mode / satisfaction declining / RSC-incompatible.
- Tier 3 (watch): EOL versions exist / satisfaction trending down.
For each Tier 1 finding: propose a concrete migration path and estimate effort (hours/days).
For each Tier 2 finding: recommend scheduling a migration in the next 1–3 months.
For each Tier 3 finding: add to the ongoing monitoring list.
Library Selection — Web Standards First
Before recommending a new dependency as a replacement, apply this order:
- Can a Web Platform / ECMAScript standard API cover this?
| Use case |
Avoid |
Use instead |
| Date / time |
moment, date-fns, dayjs |
Temporal (polyfill), or Date for simple cases |
| Array / object utilities |
lodash, ramda |
Array.prototype.{flatMap,findLast,groupBy}, Object.{entries,fromEntries,groupBy}, structuredClone() |
| HTTP requests |
axios, request |
fetch + AbortController |
| UUID generation |
uuid, nanoid |
crypto.randomUUID() |
| URL / query params |
qs, query-string |
URL, URLSearchParams |
| Number / date formatting |
numeral.js |
Intl.NumberFormat, Intl.DateTimeFormat |
- Tree-shakable? Only what is imported should end up in the bundle.
- Actively maintained? Release within the last 6 months.
- Bundle impact < 5 kb gzip? Verify with
pnpm build and a bundle analyser.
Breaking Update Procedure
- Propose as a standalone PR — never bundle with feature or refactor work.
- Read the changelog for removed APIs; grep / ast-grep the codebase for usages.
- Require
typecheck && lint && test:ci && e2e to pass before merge.
- If VRT snapshots exist, regenerate them in a Linux container after the upgrade.
Output
Write <client-repo>/.frontend-review/report/latest/md/deps-review.md with:
- Outdated packages table (name, current, latest, breaking?)
- CVE findings after attack-vector triage (priority, package, type, reason for priority)
- Trend watch findings by tier (Tier 1: migration now, Tier 2: plan, Tier 3: monitor)
- Ignored CVEs with justification (for
kpi/audit-triage.md)
- Recommended PRs: update batches + migration starting points
Boundaries
- Do NOT assess TypeScript / lint / dead code — that's
frontend-review-hygiene.
- Do NOT run the AI pentest or check HTML sinks — that's
frontend-review-security.
- Do NOT touch source files in the client repo.
Reference
- Checklist:
02-dependencies.md, 27-dependency-audit.md, 28-trend-watch.md
- Data:
data/trend-watch-config.json, data/trend-watch-history.json
- Scripts:
scripts/audit-deps.sh, scripts/audit-trend-watch.sh, scripts/fetch-trend-data.sh
- Phase:
week-1-ci-baseline.md
1---2name: frontend-review-deps3description: Use when auditing dependency health — outdated packages, CVE triage with attack-vector weighting, deprecated/declining library detection (trend-watch). Runs `audit-deps.sh` and `audit-trend-watch.sh`. Pairs with `frontend-review-security` for the full security picture.4---56# Frontend Review — Dependencies78You are auditing the dependency health of a frontend project. This covers three areas:9101. **Freshness** — outdated packages and breaking update procedures112. **CVE triage** — vulnerabilities weighted by actual attack vector, not just CVSS score123. **Trend watch** — deprecated, abandoned, or superseded libraries that should be migrated1314## Procedure15161. In parallel, run:17 - `scripts/audit-deps.sh --repo <client-repo>`18 - `scripts/audit-trend-watch.sh --repo <client-repo>`192. Read `raw/deps.json` and `raw/trend-watch.json`.203. For each CVE finding, apply the attack-vector triage matrix below before assigning priority.214. For each trend-watch finding (Tier 1/2/3), confirm the installed version and assess migration cost.2223## CVE Triage — Attack Vector Matrix2425Do not use CVSS score alone. A CVSS 9.8 RCE in a devDependency has zero production impact for a browser-only SPA.2627| CVE Type | devDep only | Runtime (SPA) | Runtime (SSR/Edge) |28|---|---|---|---|29| RCE | ignore | **ignore** | **P0** |30| Prototype Pollution | ignore | **P1** (check input path) | **P0** |31| ReDoS | ignore | **P1** (check user input reach) | **P0** |32| Path Traversal | ignore | **ignore** | **P0** |33| XSS via library | ignore | **P0** (HTML-generating libs) | **P0** |34| SSRF | ignore | **ignore** | **P0** |35| Supply Chain (postinstall malware) | CI **P0** | CI **P0** | **P0** |3637**Triage procedure:**38391. Run `pnpm audit --prod` to exclude devDeps from output.402. Focus on Prototype Pollution / ReDoS / XSS — other types are low-risk for browser-only SPAs.413. For each remaining finding, check whether user-controlled input can reach the vulnerable code path. If not, downgrade to P2.424. For SSR / Edge Functions, treat RCE / Path Traversal / SSRF as P0.435. Document every ignored CVE in `kpi/audit-triage.md` with the reason.4445```bash46# Runtime-only CVEs (excludes devDeps)47pnpm audit --prod --audit-level=moderate --json | jq '48 .vulnerabilities | to_entries[] |49 { name: .key, severity: .value.severity,50 via: [.value.via[] | select(type=="object") | .title] }'5152# Prototype Pollution / ReDoS only53pnpm audit --prod --json 2>/dev/null | jq -r '54 .vulnerabilities | to_entries[] |55 .value.via[] | select(type=="object") |56 select(.title | test("prototype|pollution|redos|regex denial"; "i")) |57 "\(.severity) \(.title) in \(.name)"' | sort -u58```5960## Trend Watch — Library Tiers6162Cross-references `package.json` against `data/trend-watch-config.json`:6364- **Tier 1 (migrate now)**: Deprecated / abandoned / superseded — no rational reason to continue. Includes libraries where migration cost is low and a mature alternative exists, even if not officially deprecated (`jest` → vitest, `axios` → ky/fetch, `cypress` → Playwright).65- **Tier 2 (plan migration)**: Maintenance mode / satisfaction declining / RSC-incompatible.66- **Tier 3 (watch)**: EOL versions exist / satisfaction trending down.6768For each Tier 1 finding: propose a concrete migration path and estimate effort (hours/days).69For each Tier 2 finding: recommend scheduling a migration in the next 1–3 months.70For each Tier 3 finding: add to the ongoing monitoring list.7172## Library Selection — Web Standards First7374Before recommending a new dependency as a replacement, apply this order:75761. **Can a Web Platform / ECMAScript standard API cover this?**7778| Use case | Avoid | Use instead |79|---|---|---|80| Date / time | moment, date-fns, dayjs | `Temporal` (polyfill), or `Date` for simple cases |81| Array / object utilities | lodash, ramda | `Array.prototype.{flatMap,findLast,groupBy}`, `Object.{entries,fromEntries,groupBy}`, `structuredClone()` |82| HTTP requests | axios, request | `fetch` + `AbortController` |83| UUID generation | uuid, nanoid | `crypto.randomUUID()` |84| URL / query params | qs, query-string | `URL`, `URLSearchParams` |85| Number / date formatting | numeral.js | `Intl.NumberFormat`, `Intl.DateTimeFormat` |86872. **Tree-shakable?** Only what is imported should end up in the bundle.883. **Actively maintained?** Release within the last 6 months.894. **Bundle impact < 5 kb gzip?** Verify with `pnpm build` and a bundle analyser.9091## Breaking Update Procedure92931. Propose as a **standalone PR** — never bundle with feature or refactor work.942. Read the changelog for removed APIs; grep / ast-grep the codebase for usages.953. Require `typecheck && lint && test:ci && e2e` to pass before merge.964. If VRT snapshots exist, regenerate them in a Linux container after the upgrade.9798## Output99100Write `<client-repo>/.frontend-review/report/latest/md/deps-review.md` with:101102- **Outdated packages** table (name, current, latest, breaking?)103- **CVE findings** after attack-vector triage (priority, package, type, reason for priority)104- **Trend watch** findings by tier (Tier 1: migration now, Tier 2: plan, Tier 3: monitor)105- **Ignored CVEs** with justification (for `kpi/audit-triage.md`)106- **Recommended PRs**: update batches + migration starting points107108## Boundaries109110- Do NOT assess TypeScript / lint / dead code — that's `frontend-review-hygiene`.111- Do NOT run the AI pentest or check HTML sinks — that's `frontend-review-security`.112- Do NOT touch source files in the client repo.113114## Reference115116- Checklist: `02-dependencies.md`, `27-dependency-audit.md`, `28-trend-watch.md`117- Data: `data/trend-watch-config.json`, `data/trend-watch-history.json`118- Scripts: `scripts/audit-deps.sh`, `scripts/audit-trend-watch.sh`, `scripts/fetch-trend-data.sh`119- Phase: `week-1-ci-baseline.md`
mizchi