dependency-audit

Status : Production Ready Last Updated : 2026-02-03 Scope : npm, pnpm, yarn projects Categories: Checks for: The dep-auditor agent can: Version : 1.0.0 Last Updated : 2026-02-03 - Critical (CVSS 9.0-10.0): Remote code execution, auth bypass - High (CVSS 7.0-8.9): Data exposure, privilege escalation - Moderate (CVSS 4.0-6.9): DoS, info disclosure - Low (CVSS 0.1-3.9): Minor issues - Major updates : Breaking changes likely (review changelog) - Minor updates : New features, backwards compatible - Patch updates : Bug fixes, safe to update - GPL licenses in commercial projects (copyleft risk) - Unknown/missing licenses - License conflicts - Deprecated packages - Abandoned packages (no updates in 2+ years) - Packages with open security issues - Parse npm/pnpm audit JSON output - Cross-reference CVE databases - Generate detailed fix recommendations - Auto-fix safe updates (with confirmation) - npm audit fix --force : May introduce breaking changes (major version bumps) - Transitive dependencies : Some vulnerabilities require updating parent packages - False positives : Some advisories may not apply to your usage - Private registries : May need auth configuration for auditing - cloudflare-worker-base : For Workers projects - testing-patterns : Run tests after updates - developer-toolbox : For commit-helper after fixes