Dependency Auditor

A multi-language toolkit for analyzing, auditing, and managing dependencies. It scans manifests and lockfiles across 8+ ecosystems to surface vulnerabilities, classify licenses, detect bloat, and produce safe, phased upgrade plans — giving teams visibility into security, legal, and maintenance risk hidden in their dependency trees.

Core Capabilities

• Vulnerability scanning & CVE matching — match direct/transitive deps against a built-in CVE database with CVSS scoring across Node, Python, Go, Rust, Ruby, Java, PHP, .NET.
• License compliance — classify into permissive / weak-copyleft / strong-copyleft / proprietary / unknown tiers and detect incompatible combinations (e.g. GPL contamination).
• Outdated & maintenance detection — categorize updates by patch/minor/major severity; flag abandoned or end-of-life packages.
• Dependency bloat analysis — find unused, redundant, or oversized packages and consolidation opportunities.
• Upgrade path planning — semver breaking-change prediction, risk matrix, prioritization, rollback strategies.
• Supply chain security — provenance checks, typosquatting/malicious-package detection, transitive risk scoring.
• Lockfile analysis — validate freshness, integrity hashes, and cross-environment consistency for deterministic builds.

When to Use