deps-check

Purpose

Audit dependency versions across the project's repositories (.claude/project.json → repos), producing a structured report of outdated packages, vulnerabilities, and cross-repo version mismatches. Scan-and-report only; acting on findings goes to the implementation agent. Placeholders <mainApp>, <device>, <infrastructure-repo> come from project.json.

Rules (never violate)

• Read-only: never run npm audit fix, npm update, or pip install --upgrade.
• Every repo in scope is scanned or its failure reported in the header; capture stderr — silent failures produce incomplete reports.
• Note the helm repo update side effect explicitly (it mutates the local chart cache and needs network).
• Outdated is not vulnerable — report severities using the registry's scale, never a custom one.
• Report stays within 200 lines; the cross-repo mismatch section always appears, even as "None found".
• Stop and ask on: a critical CVE with no patched version, missing scan tooling, no network, or a missing dependency file.

Resources

• Read resources/scan-procedure.md when running an audit — the procedure with scan commands, self-check, mistakes, escalation, failure modes.
• Read resources/output-template.md when compiling results — the report template and a complete worked-example audit.

How to use

What it does

Audits the dependency health of every repository in your project into one report: outdated packages, known vulnerabilities, and repos pinning different versions of the same shared package. It reads and reports only — never upgrading a package or touching a lockfile.

When to use it

• A periodic security review needs a current picture of dependency risk.
• You are cutting a release and want proof no known vulnerability ships.
• A CVE advisory landed, or a shared package may have drifted between repos.

Not for performing upgrades (separate task), deployment config or chart lint issues (the project's infra pack skills), single-file package.json review, or offline environments.