deps-audit-patterns

Dependency Audit Patterns Reference

Patterns and code for the /refactor:deps-audit command.

Dependency Discovery

from pathlib import Path
import json
import toml

class DependencyDiscovery:
    def __init__(self, project_path):
        self.project_path = Path(project_path)
        self.dependency_files = {
            'npm': ['package.json', 'package-lock.json', 'yarn.lock'],
            'python': ['requirements.txt', 'Pipfile', 'pyproject.toml', 'poetry.lock'],
            'ruby': ['Gemfile', 'Gemfile.lock'],
            'java': ['pom.xml', 'build.gradle'],
            'go': ['go.mod', 'go.sum'],
            'rust': ['Cargo.toml', 'Cargo.lock'],
            'dotnet': ['*.csproj', 'packages.config']
        }

    def discover_all_dependencies(self):
        """Discover all dependencies across different package managers"""
        dependencies = {}

        if (self.project_path / 'package.json').exists():
            dependencies['npm'] = self._parse_npm_dependencies()
        if (self.project_path / 'requirements.txt').exists():
            dependencies['python'] = self._parse_requirements_txt()
        if (self.project_path / 'go.mod').exists():
            dependencies['go'] = self._parse_go_mod()

        return dependencies

    def _parse_npm_dependencies(self):
        """Parse NPM package.json and lock files"""
        with open(self.project_path / 'package.json', 'r') as f:
            package_json = json.load(f)

        deps = {}
        for dep_type in ['dependencies', 'devDependencies', 'peerDependencies']:
            if dep_type in package_json:
                for name, version in package_json[dep_type].items():
                    deps[name] = {
                        'version': version,
                        'type': dep_type,
                        'direct': True
                    }
        return deps

Vulnerability Scanning

import requests

class VulnerabilityScanner:
    def __init__(self):
        self.vulnerability_apis = {
            'npm': 'https://registry.npmjs.org/-/npm/v1/security/advisories/bulk',
            'pypi': 'https://pypi.org/pypi/{package}/json',
            'maven': 'https://ossindex.sonatype.org/api/v3/component-report'
        }

    def scan_vulnerabilities(self, dependencies):
        """Scan dependencies for known vulnerabilities"""
        vulnerabilities = []

        for package_name, package_info in dependencies.items():
            vulns = self._check_package_vulnerabilities(
                package_name,
                package_info['version'],
                package_info.get('ecosystem', 'npm')
            )
            if vulns:
                vulnerabilities.extend(vulns)

        return self._analyze_vulnerabilities(vulnerabilities)

    def _check_npm_vulnerabilities(self, name, version):
        """Check NPM package vulnerabilities"""
        response = requests.post(
            'https://registry.npmjs.org/-/npm/v1/security/advisories/bulk',
            json={name: [version]}
        )

        vulnerabilities = []
        if response.status_code == 200:
            data = response.json()
            if name in data:
                for advisory in data[name]:
                    vulnerabilities.append({
                        'package': name,
                        'version': version,
                        'severity': advisory['severity'],
                        'title': advisory['title'],
                        'cve': advisory.get('cves', []),
                        'patched_versions': advisory['patched_versions']
                    })
        return vulnerabilities