loom-dependency-scan

# Dependency Scan CVEs, outdated packages, license compliance, and supply-chain risk across ecosystems. Deep-dependency companion to `loom-security-scan` (fast pre-commit/CI scanning) and `loom-security-audit` (methodology/compliance). ## Workflow 1. **Enumerate** — parse manifests + lockfiles; separate direct vs transitive. No lockfile → builds aren't reproducible (fix first). 2. **Scan** — CVEs against advisory DBs (below); note severity, affected/fixed versions, and the dependency *path*. 3. **Assess reachability** — a CVE in an unimported/dev-only path is lower priority than one on a hot code path. `govulncheck` and Snyk reason about reachability; `npm audit` does not. 4. **Remediate** — minimal safe bump to the fixed version; prefer patch/minor; verify tests. Pin the result in the lockfile. ## Scanning Commands ```bash # JS npm audit --audit-level=high | osv-scanner -r . # Python pip-audit | safety check # Rust cargo audit | cargo deny check advisories # Go govulncheck ./... | go list -m all | nancy sleuth # Ruby bundle audit --update # Java mvn org.owasp:dependency-check-maven:check # .NET dotnet list package --vulnerable --include-transitive # PHP composer audit # Any osv-scanner -r . (lockfile-driven, OSV DB, all major ecosystems in one) ``` ⚠ `--vulnerable`/audit tools only see what the **lockfile** pins — an unpinned range (`^1.2.0`) may resolve differently in CI. Sc...