dependency-security-auditlisted

# Dependency Security Audit ## Contract Audit dependency advisories plus declared runtime support. Do not inspect application security, secrets, logging, compliance, or exploits. - Run only explicitly authorized read-only audit or inventory commands. Never install tools, fix, upgrade, edit manifests/lockfiles. - Advisory findings require current tool output plus CVE/GHSA/OSV identifier. Dependency trees and manifests prove versions only, never vulnerability status. - Missing or denied audit tooling uses `method: inventory-only`; list observed versions and required authoritative check, but no vulnerability or EOL verdict. - Quote command, file, line; never guess versions or advisories. Command and fallback rules live in `references/ecosystem-commands.md`. ## Output | Dependency/runtime | Finding | Severity | Evidence | Method | Advisory/check | |---|---|---|---|---|---| `Severity` is `critical`, `high`, `medium`, `low`, or `unknown`. Close with ecosystems inspected, commands run, inventory-only gaps, explicit out-of-scope notes. Maximum seven findings.