Audit Dependencies

Dependency audit across the service repositories.

stbenjam Updated

File contents

Audit Dependencies

Reports which services pull a vulnerable or unmaintained dependency, and which of those are reachable from a request path.

Running the audit

depaudit scan --org platform writes one JSON report per repository. The shape of that report is documented in the report schema.

Reading the results

Reachability matters more than the raw CVE count. A vulnerable parser that runs only in a build script is not the same risk as one in the request path — see the triage rubric.

File one issue per reachable finding, using the issue template.

stbenjam/skillsaw/tree/main/tests/fixtures/large-skill-library/skills/audit-dependencies commit 6a081be6b2

Frequently asked questions

npx skillmds@latest add stbenjam/audit-dependencies