dependency-audit

Dependency Audit

Checking and managing third-party dependencies for known vulnerabilities and supply-chain risks. This operationalises OWASP A06 (Vulnerable and Outdated Components) at the dependency level.

---

When to run an audit

• Before shipping a new feature or release.
• When adding a new dependency.
• When a CVE advisory mentions a package you use.
• On a scheduled basis (weekly or monthly, via CI).

---

Python — pip-audit

# Install
pip install pip-audit

# Audit current environment
pip-audit

# Audit against a requirements file
pip-audit -r requirements.txt

# Exit non-zero on any vulnerability (CI gate)
pip-audit --strict

Fix: upgrade the package (pip install --upgrade <package>) or pin to a patched version in requirements.txt. If no fix is available, document the accepted risk in a comment near the pin.

---

Node / TypeScript — npm audit

# Audit and show summary
npm audit

# Show only high and critical
npm audit --audit-level=high

# Fix automatically (updates package-lock.json)
npm audit fix

# Fix including semver-major bumps (review carefully)
npm audit fix --force

For CI, prefer npm audit --audit-level=high so the exit code gates the build on high/critical findings:

npm audit --audit-level=high || { echo "High/critical vulnerabilities found"; exit 1; }

Or use audit-ci for more control:

npx audit-ci --high          # fail on high+
npx audit-ci --config .audit-ci.json   # custom config for allowlist

---

Go — govulncheck

# Install
go install golang.org/x/vuln/cmd/govulncheck@latest

# Audit the module
govulncheck ./...

# JSON output for CI parsing
govulncheck -json ./...

govulncheck only reports vulnerabilities in code paths that are actually reachable — it doesn't flag packages you import but never call.

---

Lock files — never skip them

Language	Lock file	Commit it?
Python	requirements.txt (pinned) or uv.lock / poetry.lock	Yes
Node	package-lock.json or yarn.lock or pnpm-lock.yaml	Yes
Go	go.sum	Yes