audit-dependency-versions

Audit Dependency Versions

Audit project dependencies for version staleness, known security vulnerabilities, and compatibility issues. This skill inventories all dependencies from lock files, checks each against the latest available version, classifies staleness levels, identifies security concerns, and produces a prioritized upgrade report with recommended actions.

When to Use

• Before a release to ensure dependencies are current and secure
• During periodic maintenance (monthly or quarterly dependency reviews)
• After a security advisory affects a project dependency
• When upgrading a project to a new language version (e.g., R 4.4 to 4.5)
• Before submitting a package to CRAN, npm, or crates.io
• When inheriting a project and assessing its dependency health

Inputs

• Required: Project root directory containing dependency/lock files
• Optional: Ecosystem type if not auto-detectable (R, Node.js, Python, Rust)
• Optional: Security-only mode flag (skip staleness, focus on CVEs)
• Optional: Allowlist of dependencies to skip (known acceptable older versions)
• Optional: Target date for compatibility (e.g., "must work with R 4.4.x")

Procedure

Step 1: Inventory All Dependencies

Locate and parse dependency files to build a complete inventory.

R packages:

# Direct dependencies from DESCRIPTION
grep -A 100 "^Imports:" DESCRIPTION | grep -B 100 "^[A-Z]" | head -50
grep -A 100 "^Suggests:" DESCRIPTION | grep -B 100 "^[A-Z]" | head -50

# Pinned versions from renv.lock
cat renv.lock | grep -A 3 '"Package"'

Node.js:

# Direct dependencies
cat package.json | grep -A 100 '"dependencies"' | grep -B 100 "}"
cat package.json | grep -A 100 '"devDependencies"' | grep -B 100 "}"

# Pinned versions from lock file
cat package-lock.json | grep '"version"' | head -20

Python:

# From requirements or pyproject
cat requirements.txt
cat pyproject.toml | grep -A 50 "dependencies"

# Pinned versions
cat requirements.lock 2>/dev/null || pip freeze