dependency-auditor

Run dep_scanner.py with the project path to parse manifests and lockfiles, then match dependencies against the built-in CVE pattern set. Use --format json for machine-readable output and --fail-on-high to make CI pipelines fail on high-severity findings.

Run license_checker.py on the project or pass a scanner inventory JSON with --inventory. It classifies licenses into permissive, weak/strong copyleft, proprietary, and unknown categories, then flags GPL dependencies conflicting with permissive project licenses.

The scanner parses package.json, package-lock.json, yarn.lock, requirements.txt, pyproject.toml, Pipfile.lock, poetry.lock, go.mod, go.sum, Cargo.toml, Cargo.lock, Gemfile, and Gemfile.lock. The SKILL.md also lists Java, PHP, and .NET manifest coverage.

No, the scripts work fully offline using a built-in pattern set of roughly 16 common CVEs. It is a smoke layer, so pair results with live tools like npm audit, pip-audit, or cargo audit for current advisory coverage.

Feed the scanner's JSON inventory into upgrade_planner.py to get a risk-ranked, phased migration plan. Options like --timeline, --risk-threshold, and --security-only control the planning horizon and which upgrades are included.

The offline CVE database only covers a small fixed set of known vulnerabilities, so new or unlisted CVEs are missed. Version matching uses simplified comparison logic rather than full semver range resolution, which can produce false positives or negatives.