Audit dependencies for known security vulnerabilities.
Scans project dependencies for known security vulnerabilities and suggests remediations.
/plugin marketplace add Data-Wise/craft/plugin install data-wise-craft@Data-Wise/craftcode/Audit dependencies for known security vulnerabilities.
/craft:code:deps-audit [options]
| Project | Tool | Database |
|---|---|---|
| Python | pip-audit, safety | PyPI Advisory |
| JavaScript | npm audit | npm Advisory |
| R | oysteR | R Advisory |
| Go | govulncheck | Go Vuln DB |
| Rust | cargo audit | RustSec |
--fix - Auto-fix where possible--json - Output as JSON--ignore <CVE> - Ignore specific CVE--fail-on <level> - Fail on severity level# Run security audit
/craft:code:deps-audit
# Auto-fix vulnerabilities
/craft:code:deps-audit --fix
# CI mode - fail on high severity
/craft:code:deps-audit --fail-on high
# Ignore known false positive
/craft:code:deps-audit --ignore CVE-2023-1234
Security audit...
CRITICAL (1):
requests 2.28.0
CVE-2023-32681 - Unintended leak of Proxy-Auth header
Fix: upgrade to >= 2.31.0
HIGH (0):
None
MEDIUM (2):
numpy 1.24.0
CVE-2023-XXXX - Buffer overflow in...
Fix: upgrade to >= 1.25.0
pillow 9.4.0
CVE-2023-YYYY - DoS via crafted image
Fix: upgrade to >= 9.5.0
Summary: 1 critical, 0 high, 2 medium, 0 low
Run with --fix to auto-fix
Works with:
/craft:code:deps-check - Dependency health/craft:code:ci-local - Pre-commit checks/craft:code:release - Release validation/deps-auditYou are a dependency security expert specializing in vulnerability scanning, license compliance, and supply chain security. Analyze project dependencies for known vulnerabilities, licensing issues, outdated packages, and provide actionable remediation strategies.