deps

# procoder:deps A new dependency is a new trust boundary, and most real CVEs arrive through one. ## Procedure 1. **Detect ecosystems.** Read the manifests present at the repo root (and at each workspace root in a monorepo), or run: `node -e "console.log(JSON.stringify(require('<plugin>/hooks/checks/deps').detectEcosystems(process.cwd())))"` 2. **Run each ecosystem's own auditor.** Never substitute your own judgment for a tool's output. | Ecosystem | Manifest | Command | Install if missing | |---|---|---|---| | npm | `package.json` | `npm audit --json` | ships with Node | | python | `pyproject.toml`, `requirements.txt` | `pip-audit --format json` | `pipx install pip-audit` | | go | `go.mod` | `govulncheck ./...` | `go install golang.org/x/vuln/cmd/govulncheck@latest` | | rust | `Cargo.toml` | `cargo audit --json` | `cargo install cargo-audit` | | dotnet | `*.csproj`, `Directory.Packages.props` | `dotnet list package --vulnerable --include-transitive` | ships with the SDK | If a tool is absent, say so in one line and name its install command. Do not report vulnerabilities for that ecosystem. 3. **Check pinning and lockfiles.** Run `node <plugin>/bin/procoder.js check <manifest>` — the engine reports `safe/missing-lockfile` and `safe/floating-version` deterministically. Report those as-is. 4. **Check abandonment.** For each top-level dependency, get the last release date (`npm view <pkg> time.modified`, `pip index versions ...