dependency-cve-audit--patcherlisted

# Dependency CVE Audit & Patcher ## 1. System Architecture & Prerequisites - Python 3.10+ (stdlib only: `re`, `os`, `json`, `subprocess`, `argparse`, `pathlib`) - Node.js 18+ with npm available on PATH (for the `npm audit --json` backend) - Target manifest: `package.json` (JS) or `requirements.txt` (Python, PEP 508 syntax) - Optional CVE list file: JSON array of `{package, versions[], cve_id, severity, patched[]}` for offline (Python-only) mode ## 2. Input/Output Data Contracts **Input (CLI args):** ```json { "type": "object", "properties": { "manifest": { "type": "string", "description": "Path to package.json or requirements.txt" }, "wordlist-report": { "type": "string", "description": "Output CVE report JSON path", "default": "./cve_report.json" }, "fix-mode": { "type": "boolean", "description": "Generate npm audit fix + safe update commands", "default": false }, "dry-run": { "type": "boolean", "description": "Print dependency-lock diff plan without executing", "default": false } }, "required": ["manifest"] } ``` **Output artifacts:** - `{wordlist-report}` — JSON CVE report (`dependency`, `cve`, `severity`, `range`, `patched`, `action`) - `{cve_dir}/npm_audit_fix_commands.sh` — fix command list (when `--fix-mode`) - `{cve_dir}/dependency_lock_diff.json` — dry-run lock diff plan (when `--dry-run`) ## 3. Production Reference Implementation ```python #!/usr/bin/env python3 """Dependency CVE Audit & Patcher — npm audit backend + offline CVE list fa