Depcheck

Dependency Analysis with Socket

Use the Socket CLI (@socketsecurity/cli) to check for CVEs in direct and transitive dependencies. Also covers native audit commands for npm, yarn, pnpm, bun, and Python/uv.

Prerequisites

npm install -g @socketsecurity/cli
socket login   # or: export SOCKET_SECURITY_API_TOKEN=<token>

Check a single package for CVEs

socket package score npm <package> --markdown     # deep (includes transitives)
socket package shallow npm <package>              # shallow (package only)
socket package shallow npm react lodash eslint    # multiple packages
socket package score pypi <package> --markdown    # Python/PyPI deep score
socket package shallow pypi <package>             # Python/PyPI shallow score

Check a project for CVEs

socket scan create <dir> --report                # full scan
socket ci                                        # CI gate (non-zero on failure)
socket scan create . --json | jq '.alerts[] | select(.severity == "critical")'

Native audit commands (no Socket required)

No lockfile? Use npx audit-ci --high.

npm

npm audit --audit-level=high
npm audit --json | jq '.vulnerabilities | to_entries[] | select(.value.severity == "high" or .value.severity == "critical")'

yarn v1

yarn audit --level high

yarn v4+ (berry)

yarn npm audit --all --severity high

pnpm

pnpm audit --audit-level=high
pnpm audit --audit-level=medium     # include medium-severity CVEs
pnpm audit --fix                    # write overrides to pnpm-workspace.yaml

bun

bun audit --audit-level high

Python / uv

uv audit                      # uv-native audit of pyproject.toml + uv.lock (OSV); non-zero on findings
uvx pip-audit                 # pip-audit on current env (works without uv)
uvx pip-audit -r requirements.txt
uv audit --format json        # machine-readable output

• uv audit is in preview and requires uv >= 0.10.12: uv self update.
• Enable malware checks on every uv add / uv sync with UV_MALWARE_CHECK=1 — aborts sync before known-malicious code runs.

Secure install wrapper

socket npm install           # drop-in npm replacement with scanning
socket npx <package>         # scans before executing
socket wrapper --on/--off    # toggle globally

Pin dependency versions

Before pinning, check for a lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock, bun.lock, uv.lock, poetry.lock, Pipfile.lock). If one exists, update it with the package manager's install command rather than hand-editing pins.

All dependencies in package.json MUST be pinned to exact versions. No semver ranges (^, ~, *, >, <, >=, <=). Applies to dependencies, devDependencies, peerDependencies, and optionalDependencies.

See references/pinning.md for rationale, examples, and update workflow.

Pin GitHub Actions to commit SHAs

All GitHub Actions MUST be referenced by their full commit SHA, NOT by version tags or branch names. Applies to every uses: directive in workflows.

Use git ls-remote https://github.com/<owner>/<repo> refs/tags/<version> to find the SHA. Keep the version tag as a trailing comment for readability.

See references/github-actions.md for rationale and examples.

Set minimum release cooldown period

Set minimumReleaseAge of 7 days in workspace or lockfiles.

References

• Socket CLI docs — full command reference, score interpretation, alert severity levels
• Socket package scores — scoring dimensions and methodology
• Alert types — CVE, supply chain, quality, maintenance, license alerts