dependency-auditor

Run dep_scanner.py with the project path to parse dependency manifests and match them against the built-in CVE database. Use --format json for machine-readable output or --fail-on-high to make CI pipelines fail when high-severity vulnerabilities are found.

Run license_checker.py against the project directory or pass a dependency inventory JSON with --inventory. It classifies licenses into permissive, weak copyleft, strong copyleft, and proprietary categories, then reports conflicts against your project license with a compliance score.

The scanner parses package.json, package-lock.json, and yarn.lock for npm; requirements.txt, pyproject.toml, Pipfile.lock, and poetry.lock for Python; go.mod for Go; Cargo.toml and Cargo.lock for Rust; and Gemfile and Gemfile.lock for Ruby.

No, all three scripts use only the Python standard library and require Python 3.7 or higher. There is nothing to install beyond making the scripts executable with chmod.

The tool matches dependencies against a built-in vulnerability database covering common CVE patterns, so it will miss newly disclosed or obscure vulnerabilities. You can extend the database by modifying the _load_vulnerability_database method or loading a custom JSON feed.

Run upgrade_planner.py with a dependency inventory JSON produced by dep_scanner.py. It classifies upgrades by risk level, supports --security-only and --risk-threshold filters, and splits work into three phases across your chosen timeline.