Analyze Dependencies

Overview

Audit the project's dependency tree across five risk dimensions: freshness, vulnerabilities, bundle impact, license compliance, and maintenance status. Produce a risk-scored report with actionable recommendations for each dependency.

Workflow

1. Read project context — Check .chalk/docs/engineering/ for:

   • Architecture docs (to understand which dependencies are critical path)
   • Previous dependency audits
   • Any documented dependency policies or license requirements

2. Locate dependency manifests — Scan the project for:

   • package.json / package-lock.json / yarn.lock / pnpm-lock.yaml (Node.js)
   • pyproject.toml / requirements.txt / Pipfile / poetry.lock (Python)
   • pubspec.yaml / pubspec.lock (Dart/Flutter)
   • Cargo.toml / Cargo.lock (Rust)
   • go.mod / go.sum (Go)