Dependency Auditor

When to Use

Use for dependency security reviews, lockfile changes, upgrade planning, license evidence collection, or an existing project's dependency inventory. Use a dedicated performance workflow when the question is actual bundle size. Do not infer vulnerabilities, latest releases, or legal compliance from names alone.

Evidence Contract

Keep three distinct outputs: what is installed, what has been checked against current evidence, and what changes have been tested. An inventory is not an advisory database or a dependency resolver. An empty finding list does not prove that a scan ran successfully. Record the repository revision, lockfiles, runtime, scanner version, and scan date. State unavailable databases, private registries, excluded workspaces, and parse errors. Never turn not_assessed into passed in a report or CI gate.