dependency-audit git:20260710.7fdf9e2A

Immutable. This exact content is served forever at /api/v1/blob/975b377acc0a192f.

---
name: dependency-audit
description: |
  Dependency audit: known CVEs, licence compliance, abandoned/outdated packages, lockfile integrity, and a
  justification for every new dependency.
  Trigger phrases: "dependency", "dependency audit", "npm audit", "package security", "CVE", "license"
---

# Dependency Audit

## Audit axes
1. **Known vulnerabilities (CVE):** audit appropriate to the ecosystem
   ```bash
   npm audit --production           # Node
   dotnet list package --vulnerable # .NET
   pip-audit                        # Python
   ```
2. **License compliance:** flag licenses incompatible with the project such as copyleft/GPL (a risk in commercial closed source).
3. **Maintenance status:** note abandoned / long-unmaintained / single-maintainer packages.
4. **Transitive dependencies:** also scan vulnerabilities in indirect dependencies.
5. **Lockfile integrity:** lockfile committed and consistent with the manifest; versions pinned.
6. **Justification for new dependencies:** is it actually needed? Don't add a heavy package for a single small function (supply-chain surface).

## Output
Severity-sorted list: `package · version · issue (CVE/license/maintenance) · upgrade path`.

## DoD
- 0 known HIGH/CRITICAL vulnerabilities; licenses compliant; lockfile consistent; every new package justified.