Dependency Scan

CVEs, outdated packages, license compliance, and supply-chain risk across ecosystems. Deep-dependency companion to loom-security-scan (fast pre-commit/CI scanning) and loom-security-audit (methodology/compliance).

Workflow

1. Enumerate — parse manifests + lockfiles; separate direct vs transitive. No lockfile → builds aren't reproducible (fix first).
2. Scan — CVEs against advisory DBs (below); note severity, affected/fixed versions, and the dependency path.
3. Assess reachability — a CVE in an unimported/dev-only path is lower priority than one on a hot code path. govulncheck and Snyk reason about reachability; npm audit does not.
4. Remediate — minimal safe bump to the fixed version; prefer patch/minor; verify tests. Pin the result in the lockfile.

Scanning Commands