dependency-auditlisted

# Dependency Audit Read-only analysis patterns for dependency security, license compliance, and health assessment. This skill does NOT auto-upgrade packages -- it helps you understand your dependency landscape and make informed decisions. ## Security-First Principles | Principle | Practice | |-----------|----------| | Audit before merge | Run security checks in CI on every PR | | Understand before upgrading | Read changelogs, check breaking changes | | Never blindly force-fix | `npm audit fix --force` can introduce breaking changes | | Pin production dependencies | Use exact versions or lock files | | Verify publisher identity | Check package ownership, download counts, repo activity | ## Security Audit Workflow ### Step 1: Run the Audit ```bash # npm (built-in) npm audit # npm -- JSON output for parsing npm audit --json # Yarn yarn audit # pnpm pnpm audit ``` ### Step 2: Read the Report ``` # Example npm audit output ┌───────────────┬──────────────────────────────────────────────┐ │ Severity │ high │ ├───────────────┼──────────────────────────────────────────────┤ │ Package │ lodash │ │ Dependency of │ my-library │ │ Path │ my-library > lodash │ │ More info │ https://github.com/advisories/GHSA-xxxx-xxxx │ └───────────────┴──────────────────────────────────────────────┘ ``` ### Step 3: Assess Each Vulnerab