dependency-auditlisted

# Dependency Audit Checking and managing third-party dependencies for known vulnerabilities and supply-chain risks. This operationalises OWASP A06 (Vulnerable and Outdated Components) at the dependency level. --- ## When to run an audit - Before shipping a new feature or release. - When adding a new dependency. - When a CVE advisory mentions a package you use. - On a scheduled basis (weekly or monthly, via CI). --- ## Python — pip-audit ```bash # Install pip install pip-audit # Audit current environment pip-audit # Audit against a requirements file pip-audit -r requirements.txt # Exit non-zero on any vulnerability (CI gate) pip-audit --strict ``` Fix: upgrade the package (`pip install --upgrade <package>`) or pin to a patched version in `requirements.txt`. If no fix is available, document the accepted risk in a comment near the pin. --- ## Node / TypeScript — npm audit ```bash # Audit and show summary npm audit # Show only high and critical npm audit --audit-level=high # Fix automatically (updates package-lock.json) npm audit fix # Fix including semver-major bumps (review carefully) npm audit fix --force ``` For CI, prefer `npm audit --audit-level=high` so the exit code gates the build on high/critical findings: ```bash npm audit --audit-level=high || { echo "High/critical vulnerabilities found"; exit 1; } ``` Or use `audit-ci` for more control: ```bash npx audit-ci --high # fail on high+ npx audit-ci --config .audit-ci.json # custom config for