deps-auditlisted

# Dependency Audit and Management ## Quick Reference | Task | Approach | |------|----------| | Security scan | Run language-specific audit command | | Find outdated | Check against latest versions | | Find unused | Analyze imports vs declared dependencies | | Update safely | Minor/patch first, test, then major | | Lock files | Always commit lock files | ## Package Manager Detection | File | Package Manager | Audit Command | |------|----------------|---------------| | `pnpm-lock.yaml` | pnpm | `pnpm audit` | | `package-lock.json` | npm | `npm audit` | | `yarn.lock` | yarn | `yarn audit` | | `bun.lockb` | bun | `bun audit` (if available) | | `requirements.txt` | pip | `pip-audit` | | `pyproject.toml` (with uv) | uv | `uv pip audit` | | `poetry.lock` | poetry | `poetry audit` (via plugin) | | `Cargo.lock` | cargo | `cargo audit` | | `go.sum` | go | `govulncheck ./...` | ## Security Vulnerability Scanning ### Node.js ```bash # Check for known vulnerabilities pnpm audit # or npm audit # Auto-fix compatible updates pnpm audit --fix # or npm audit fix # See what would change without applying npm audit fix --dry-run # Force fixes (may include breaking changes) npm audit fix --force # Use with caution ``` ### Python ```bash # Install pip-audit if not present pip install pip-audit # Scan requirements.txt pip-audit -r requirements.txt # Scan installed packages pip-audit # Output as JSON for processing pip-audit --format json # Fix vulnerabilities pip-audit --fix -r requ