dependency-audit

Adding a third-party dependency is a supply-chain decision, not a convenience. Every package you pull in runs its code on your machine and in CI, ships you its transitive dependencies, and inherits your trust. So nothing enters the project — in any language, direct or transitive — until it has passed the audit below.