Dependency Audit

Commands by Ecosystem

Note: govulncheck performs reachability analysis — it only reports vulnerabilities in code paths that are actually called. This is a strength: a CRITICAL CVE in an unused function is lower risk than a MEDIUM CVE in a hot path.

Triage Framework

Not all vulnerabilities are equal. Triage by severity AND reachability:

How to Check Reachability

# Go: built-in reachability analysis
govulncheck ./...

# Node.js: check if vulnerable function is imported
grep -r "require.*vulnerable-package" src/
grep -r "from.*vulnerable-package" src/

# Python: check if vulnerable module is used
grep -r "import vulnerable_package" src/
grep -r "from vulnerable_package" src/

Remediation Strategies

Strategy 1: Direct Upgrade (Preferred)

# Node.js
npm update affected-package
# If major version: npm install affected-package@latest

# Python
pip install --upgrade affected-package
# Or update requirements.txt/pyproject.toml constraint

# Go
go get affected-package@latest
go mod tidy

Strategy 2: Patch via Override (When Direct Upgrade Breaks Things)

// package.json — force a transitive dependency to a fixed version
{
  "overrides": {
    "vulnerable-transitive-dep": ">=2.1.1"
  }
}

# pyproject.toml — constraint on transitive dependency
[tool.pip-audit]
ignore = ["PYSEC-2024-XXX"]  # Only if confirmed unreachable

Strategy 3: Replace Package (When No Fix Available)

If the package is abandoned or the maintainer won't patch:

1. Search for maintained alternatives (npm search, pip search)
2. Evaluate alternatives for API compatibility
3. Create migration task with estimated effort
4. Replace and verify all tests pass

Supply Chain Checks

• Lockfile exists and is committed (package-lock.json, yarn.lock, Pipfile.lock, go.sum)
• No unpinned dependencies ("^", "~", "*" ranges in package.json)
• No suspicious postinstall/preinstall scripts in dependencies
• Registries point to official sources (no untrusted private registries)
• Docker base images pinned to specific SHA or version tag (not :latest)
• Dependencies downloaded over HTTPS (no HTTP registry URLs)

License Compliance

# Node.js: check all licenses
npx license-checker --summary --production

# Python
pip-licenses --format=table --with-urls

Structured Output

## Dependency Audit Results

| Package | Ecosystem | Current | Vulnerability | CVE | Severity | Fix Version | Reachable? |
|---------|-----------|---------|---------------|-----|----------|-------------|------------|
| express | npm | 4.17.1 | Prototype pollution | CVE-2024-XXXX | HIGH | 4.18.0 | Yes |
| requests | pip | 2.28.0 | SSRF via redirect | CVE-2023-XXXX | MEDIUM | 2.31.0 | Unknown |

### Summary
- **Total vulnerabilities:** 5
- **Critical (reachable):** 0
- **High (reachable):** 1 — blocks deployment
- **Outdated packages:** 12 (3 with security implications)
- **License issues:** 0
- **Supply chain risks:** 1 (missing lockfile for Python service)

Anti-Patterns

• Ignoring audit output — running npm audit and dismissing all findings without triage; every finding needs a decision (fix, accept risk, or mark unreachable)
• Force-resolving without understanding — using npm audit fix --force blindly; this can introduce breaking changes from major version bumps
• Unpinned dependencies in production — using ^ or ~ ranges means builds are non-deterministic; pin exact versions for production
• No lockfile committed — without a lockfile, every npm install or pip install can pull different versions
• Ignoring transitive vulnerabilities — "it's not our code" is not an excuse; you ship the transitive dependency to your users
• Using abandoned packages — packages with no commits in 2+ years and open CVEs should be replaced

Checklist

• Vulnerability scan completed for all ecosystems in project-config.md
• All CRITICAL and HIGH findings triaged (reachability checked)
• Remediation plan created for findings above MEDIUM
• Lockfiles exist and are committed for all ecosystems
• No unpinned dependencies in production configs
• License compatibility verified (no GPL/AGPL in proprietary code)
• Supply chain checks passed (no suspicious scripts, official registries only)
• Outdated packages identified with upgrade timeline
• Findings documented in structured output format