Dependency Audit

Audits project dependencies for known security vulnerabilities across multiple package ecosystems.

Purpose & Scope

• •Detect vulnerable dependencies using ecosystem-specific tools
• •Support multiple ecosystems: npm, NuGet, pip, Go modules, Bundler, Cargo
• •Classify vulnerabilities by severity (Critical/High/Medium/Low)
• •Provide fix recommendations with safe auto-fix guidance
• •Return normalized report to parent orchestrator (ln-760)

When to Use

• •During project bootstrap (via ln-760-security-setup)
• •CI/CD pipeline security checks
• •Pre-release security validation
• •Regular scheduled audits

Workflow

Phase 1: Ecosystem Detection

Step 1: Detect Package Managers

• •Check for package.json / package-lock.json (npm)
• •Check for *.csproj / packages.config (.NET)
• •Check for requirements.txt / Pipfile / pyproject.toml (Python)
• •Check for go.mod (Go)
• •Check for Gemfile (Ruby), Cargo.toml (Rust), composer.json (PHP)

Step 2: Check Tool Availability

• •For each detected ecosystem, verify audit tool is available
• •If tool missing: log warning, skip ecosystem (do not fail)

Phase 2: Audit Execution

Step 1: Run Ecosystem Audits

• •Execute audit command for each detected ecosystem
• •Prefer JSON output for parsing (see references/audit_commands.md)
• •Run audits in parallel where possible

Step 2: Parse Results

• •Normalize findings to common format: package, version, vulnerability ID, severity
• •Extract CVSS score if available

Phase 3: Report Generation

Step 1: Severity Classification

• •Map CVSS scores to severity per references/severity_mapping.md
• •Critical: CVSS 9.0-10.0
• •High: CVSS 7.0-8.9
• •Medium: CVSS 4.0-6.9
• •Low: CVSS 0.1-3.9

Step 2: Group and Sort

• •Group by ecosystem
• •Sort by severity (Critical first)
• •Include vulnerability count summary

Step 3: Build Report

• •Include package name, current version, fixed version
• •Include vulnerability ID (CVE/GHSA/OSV)
• •Do NOT include exploit details

Phase 4: Fix Recommendations

Step 1: Classify Fix Type

• •Patch update (safe auto-fix)
• •Minor update (usually safe)
• •Major update (manual review required)
• •No fix available (document and monitor)

Step 2: Generate Recommendations

• •For each vulnerability: suggest fix command
• •Flag breaking changes if major version bump
• •Note if fix requires code changes

Step 3: Return Results

• •Return structured report to orchestrator
• •Include summary: packages audited, vulnerabilities found, by severity

Critical Rules

1. •Never auto-fix major versions - may introduce breaking changes
2. •Verify lock file integrity - regenerate if corrupted
3. •Respect severity thresholds - per environment (see references/severity_mapping.md)
4. •Document unfixable vulns - add to known issues with review date
5. •No exploit code - report IDs only, not exploitation details

Definition of Done

• • All detected ecosystems audited
• • Findings classified by severity with CVSS mapping
• • Fix recommendations provided (safe vs manual)
• • Report in normalized format returned
• • Critical vulnerabilities prominently flagged
• • Lock file integrity verified

Reference Files

Version: 2.0.0 Last Updated: 2026-01-10