sagargupta16/deps-audit

Dependency Audit and Management

Quick Reference

| Task | Approach | |------|----------| | Security scan | Run language-specific audit command | | Find outdated | Check against latest versions | | Find unused | Analyze imports vs declared dependencies | | Update safely | Minor/patch first, test, then major | | Lock files | Always commit lock files |

Package Manager Detection

| File | Package Manager | Audit Command | |------|----------------|---------------| | pnpm-lock.yaml | pnpm | pnpm audit | | package-lock.json | npm | npm audit | | yarn.lock | yarn | yarn audit | | bun.lockb | bun | bun audit (if available) | | requirements.txt | pip | pip-audit | | pyproject.toml (with uv) | uv | uv pip audit | | poetry.lock | poetry | poetry audit (via plugin) | | Cargo.lock | cargo | cargo audit | | go.sum | go | govulncheck ./... |

Security Vulnerability Scanning

Node.js

# Check for known vulnerabilities
pnpm audit
# or
npm audit

# Auto-fix compatible updates
pnpm audit --fix
# or
npm audit fix

# See what would change without applying
npm audit fix --dry-run

# Force fixes (may include breaking changes)
npm audit fix --force  # Use with caution

Python

# Install pip-audit if not present
pip install pip-audit

# Scan requirements.txt
pip-audit -r requirements.txt

# Scan installed packages
pip-audit

# Output as JSON for processing
pip-audit --format json

# Fix vulnerabilities
pip-audit --fix -r requirements.txt

Rust

# Install cargo-audit
cargo install cargo-audit

# Scan for vulnerabilities
cargo audit

# Auto-fix compatible updates
cargo audit fix

Go

# Install govulncheck
go install golang.org/x/vuln/cmd/govulncheck@latest

# Scan for vulnerabilities
govulncheck ./...

Outdated Package Detection

Node.js

# List outdated packages
pnpm outdated
# or
npm outdated

# Interactive update (pnpm)
pnpm update --interactive --latest

Python

# List outdated packages
pip list --outdated

# With pip-tools
pip-compile --upgrade requirements.in

Rust

# Install cargo-outdated
cargo install cargo-outdated

# List outdated
cargo outdated

Go

# List available updates
go list -m -u all

# Update all dependencies
go get -u ./...
go mod tidy

Unused Dependency Detection

Node.js

# Install depcheck
npx depcheck

# Common false positives to ignore:
# - Babel plugins (loaded by config)
# - ESLint plugins (loaded by config)
# - TypeScript type packages (@types/*)
# - PostCSS plugins

Python

Manually check: search codebase for each package name in imports.

# Check if a specific package is imported anywhere
grep -r "import package_name" src/
grep -r "from package_name" src/

Update Strategy

Safe Update Order

1. Patch updates first (1.2.3 -> 1.2.4): Bug fixes, safe to batch
2. Minor updates (1.2.3 -> 1.3.0): New features, backward-compatible
3. Major updates (1.2.3 -> 2.0.0): Breaking changes, update one at a time

For Each Major Update

1. Read the changelog/migration guide
2. Update the single package
3. Run the full test suite
4. Fix any breaking changes
5. Commit before moving to the next

Automated Updates

Use Renovate or Dependabot for automated PRs:

Renovate (recommended):

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["config:recommended"],
  "schedule": ["on the first day of the month"],
  "groupName": "all dependencies",
  "groupSlug": "all"
}

Dependabot:

# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: npm
    directory: /
    schedule:
      interval: monthly
    groups:
      all-dependencies:
        patterns: ["*"]

Lock File Management

| Lock File | Must Commit? | Why | |-----------|-------------|-----| | package-lock.json | Yes | Ensures reproducible builds | | pnpm-lock.yaml | Yes | Same | | yarn.lock | Yes | Same | | Cargo.lock (binary) | Yes | Reproducible builds for binaries | | Cargo.lock (library) | Debatable | Libraries usually don't commit | | go.sum | Yes | Integrity verification | | poetry.lock | Yes | Reproducible environments | | requirements.txt (pinned) | Yes | Acts as lock file |

Common Issues

| Problem | Solution | |---------|----------| | Conflicting peer dependencies | Check compatibility matrix, may need --legacy-peer-deps | | "ERESOLVE unable to resolve" | Peer dependency conflict - check versions | | Vulnerability in transitive dep | Use overrides (npm) or resolutions (yarn) to force version | | Lock file conflicts after merge | Delete lock file, reinstall, commit new lock | | pip-audit finds no fix available | Pin to latest patched version or find alternative package | | Cargo feature conflicts | Check feature flags in Cargo.toml |

Transitive Dependency Overrides

When a vulnerability exists in a transitive (indirect) dependency:

npm/pnpm (package.json)

{
  "overrides": {
    "vulnerable-package": ">=2.0.1"
  }
}

Yarn (package.json)

{
  "resolutions": {
    "vulnerable-package": ">=2.0.1"
  }
}

Anti-Patterns

| Don't | Do Instead | |-------|-----------| | Ignore audit warnings | Triage and fix or document exceptions | | Use * or latest for versions | Pin to specific semver ranges | | Skip lock files in commits | Always commit lock files | | Update everything at once | Update in safe order (patch -> minor -> major) | | Suppress audit exit codes in CI | Fix vulnerabilities or add documented exceptions | | Install from master branch | Use published releases with version numbers |