dependency-audit

Run pip-audit against your requirements file with 'pip-audit -r requirements.txt' or against the installed environment directly. It checks each pinned version against the OSV vulnerability database and reports CVEs with fix availability.

Run 'npm audit --omit=dev' to scan production dependencies for known vulnerabilities. For deeper coverage including containers and filesystems, use trivy with severity filters like 'trivy fs . --severity HIGH,CRITICAL'.

Use npm 'overrides' or a pip constraint pin to force the patched version of the transitive package, then verify the dependency tree resolved correctly. After deploying, check logs for exploitation signatures since the CVE disclosure date.

Verify the exact package name against official docs to avoid typosquats, check maintenance health and install scripts, and measure transitive cost with 'npm ls --all' or pipdeptree. Prefer stdlib or existing dependencies for small functionality.

npm install resolves version ranges at install time, so a hijacked or broken release can enter your build unpredictably. Use 'npm ci' to install reproducibly from the committed lockfile, and add a cooldown period for fresh releases.

When the vulnerable code path is unreachable in your usage or not exploitable in your deployment configuration, you can schedule it with normal updates. Always document the reasoning rather than silently ignoring the finding.