dependency-checker

Dependency Checker

Audit all project dependencies for outdated packages, security vulnerabilities, and breaking changes. Produce a prioritized update plan. Multi-stack aware.

Detection Strategy

Scan the project to find all dependency manifests:

• **/package.json (not in node_modules/) — npm/yarn/pnpm projects
• **/go.mod — Go modules
• **/requirements.txt / **/pyproject.toml / **/Pipfile — Python projects
• **/Cargo.toml — Rust projects
• **/pom.xml / **/build.gradle — Java projects
• **/Gemfile — Ruby projects

Audit Process

Phase 1: Outdated Packages

For each dependency manifest found:

npm:

npm outdated --json 2>/dev/null

Go:

go list -m -u all 2>/dev/null | grep '\[.*\]'

Python:

pip list --outdated --format=json 2>/dev/null

Rust:

cargo outdated 2>/dev/null

For each outdated package, note:

• Current version vs latest
• Major/minor/patch bump
• Production or dev dependency

Phase 2: Security Audit

npm:

npm audit --production 2>/dev/null

Go (if govulncheck installed):

govulncheck ./... 2>/dev/null || echo "govulncheck not installed — install with: go install golang.org/x/vuln/cmd/govulncheck@latest"

Python (if pip-audit installed):

pip-audit 2>/dev/null || echo "pip-audit not installed — install with: pip install pip-audit"

Rust (if cargo-audit installed):

cargo audit 2>/dev/null || echo "cargo-audit not installed — install with: cargo install cargo-audit"

Phase 3: Categorize by Risk

CRITICAL — Security vulnerabilities with known exploits

• npm audit critical or high severity
• govulncheck/pip-audit/cargo-audit findings with CVE
• Dependencies with known RCE, injection, or auth bypass

HIGH — Major version updates with breaking changes

• Major version bumps (v2 -> v3)
• Core frameworks and libraries
• Changes that require code modifications

MEDIUM — Minor/patch updates for production dependencies

• Minor version bumps with new features
• Patch updates fixing bugs
• Production dependencies only