依赖审计完整指南：安全漏洞扫描、过时包检测与清理工作流

dependency-audit by bobmatnyc/claude-mpm-skills

135 周安装量

27 GitHub Stars

GitHub

安装命令

npx skills add https://github.com/bobmatnyc/claude-mpm-skills --skill dependency-audit

软件维护开发安全

🇨🇳中文介绍

依赖审计技能

概述

用于审计、更新和清理项目依赖的系统化工作流程。涵盖安全漏洞扫描、过时包检测、未使用依赖项移除以及从已弃用库迁移。

使用时机

每周/每月的依赖维护
安全公告（CVE 发布）之后
主要版本发布之前
当构建包大小意外增加时
在代码审查依赖变更时
接手遗留项目时

快速审计流程

1. 检查过时包

# npm
npm outdated

# pnpm
pnpm outdated

# yarn
yarn outdated

# pip (Python)
pip list --outdated

# poetry (Python)
poetry show --outdated

2. 安全漏洞扫描

# npm
npm audit
npm audit fix          # 自动修复可能的问题
npm audit fix --force  # 强制主版本更新（有风险）

# pnpm
pnpm audit
pnpm audit --fix

# yarn
yarn audit
yarn audit --fix

# Python
pip-audit              # 需要：pip install pip-audit
safety check           # 需要：pip install safety

3. 查找未使用的依赖

# JavaScript/TypeScript
npx depcheck

# 输出示例：
# 未使用的依赖项
# * lodash
# * moment
# 未使用的开发依赖项
# * @types/old-package

# Python
pip-autoremove --list  # 需要：pip install pip-autoremove

广告位招租

在这里展示您的产品或服务

触达数万 AI 开发者，精准高效

联系我们

JavaScript/TypeScript/Node.js

# 检查哪些包已过时
npm outdated

# 在 semver 范围内更新（安全）
npm update

# 将特定包更新到最新版本
npm install package@latest

# 检查安全漏洞
npm audit

# 自动修复漏洞
npm audit fix

# 查看依赖树
npm list
npm list --depth=0  # 仅顶层依赖

# 为什么安装了这个包？
npm ls package-name

# 检查重复包
npm dedupe

# 检查过时包
pnpm outdated

# 更新所有依赖项
pnpm update

# 更新特定包
pnpm update package@latest

# 安全审计
pnpm audit

# 去重
pnpm dedupe

# 列出所有包
pnpm list

# 检查过时包
yarn outdated

# 交互式升级（推荐）
yarn upgrade-interactive

# 更新所有包
yarn upgrade

# 安全审计
yarn audit

# 为什么有这个包？
yarn why package-name

# 列出过时包
pip list --outdated

# 更新特定包
pip install --upgrade package-name

# 安全审计
pip-audit  # 安装：pip install pip-audit

# 冻结当前依赖项
pip freeze > requirements.txt

# 检查包的依赖项
pip show package-name

# 显示过时包
poetry show --outdated

# 更新所有包
poetry update

# 更新特定包
poetry update package-name

# 安全检查
poetry audit  # 需要 poetry-audit-plugin

# 显示依赖树
poetry show --tree

# 检查安全漏洞
pipenv check

# 更新所有包
pipenv update

# 更新特定包
pipenv update package-name

# 显示依赖图
pipenv graph

优先级	类型	操作	时间线	示例
P0	关键 CVE（正被利用）	立即修补	当天	身份验证绕过、RCE
P1	高严重性 CVE 或主要框架更新	规划迁移	1-2 周	Next.js、React 主版本
P2	已弃用但正在使用	寻找替代品	2-4 周	moment.js → date-fns
P3	次要/补丁更新	批量更新	每月	非破坏性更新
P4	未使用的依赖项	移除	下一次清理 PR	死代码导入

是否存在 CVE？
├─ 是 → 是否为关键/高严重性？
│  ├─ 是 → P0（立即修补）
│  └─ 否 → P1（规划更新）
└─ 否 → 包是否已弃用？
   ├─ 是 → 是否正在使用？
   │  ├─ 是 → P2（寻找替代品）
   │  └─ 否 → P4（移除）
   └─ 否 → 是否已过时？
      ├─ 主版本 → P1（规划迁移）
      ├─ 次要/补丁 → P3（批量更新）
      └─ 未使用 → P4（移除）

JavaScript/TypeScript

// ❌ moment.js (已弃用，288KB 最小化)
import moment from 'moment';
const formatted = moment().format('YYYY-MM-DD');
const diff = moment(date1).diff(moment(date2), 'days');

// ✅ date-fns (支持 tree-shaking，每个函数 2-5KB)
import { format, differenceInDays } from 'date-fns';
const formatted = format(new Date(), 'yyyy-MM-dd');
const diff = differenceInDays(date1, date2);

// ✅ 原生 Intl (零构建包成本)
const formatted = new Intl.DateTimeFormat('en-US').format(new Date());
const relative = new Intl.RelativeTimeFormat('en').format(-1, 'day'); // "1 day ago"

# ❌ arrow (简单任务开销大)
import arrow
now = arrow.now().format('YYYY-MM-DD')

# ✅ 原生 datetime
from datetime import datetime
now = datetime.now().strftime('%Y-%m-%d')

# ✅ pendulum (用于复杂时区处理)
import pendulum
now = pendulum.now('America/New_York')

JavaScript/TypeScript

// ❌ 完整 lodash 导入 (70KB)
import _ from 'lodash';
const value = _.get(obj, 'path.to.value');
const unique = _.uniq(array);

// ✅ 特定导入 (5-10KB)
import get from 'lodash/get';
import uniq from 'lodash/uniq';

// ✅ 原生替代方案 (0KB)
const value = obj?.path?.to?.value;           // 可选链
const unique = [...new Set(array)];           // Set
const keys = Object.keys(obj);                // Object.keys
const flat = array.flat();                    // Array.flat()
const grouped = Object.groupBy(arr, fn);      // Object.groupBy

JavaScript/TypeScript

// ❌ axios (11KB) - 通常不必要
import axios from 'axios';
const { data } = await axios.get('/api/users');

// ✅ 原生 fetch (0KB) - 内置
const response = await fetch('/api/users');
const data = await response.json();

// ✅ ky (2KB) - 如果需要重试/超时
import ky from 'ky';
const data = await ky.get('/api/users').json();

# ❌ requests (对无服务器应用来说较大)
import requests
response = requests.get('https://api.example.com')

# ✅ httpx (支持异步，相同 API)
import httpx
async with httpx.AsyncClient() as client:
    response = await client.get('https://api.example.com')

# ✅ urllib (原生，适用于简单情况)
from urllib.request import urlopen
response = urlopen('https://api.example.com')

JavaScript/TypeScript

// 考虑整合测试运行器

// 如果单独使用 Jest + Vitest + Playwright：
// ✅ Vitest 可以在大多数项目中替代 Jest（更快，原生 ESM）
// ✅ 保留 Playwright 用于 E2E，使用 Vitest 进行单元/集成测试

JavaScript/TypeScript

// ❌ 多个验证库
import * as yup from 'yup';
import Joi from 'joi';
import { z } from 'zod';

// ✅ 选择一个（推荐 TypeScript 使用 Zod）
import { z } from 'zod';
const schema = z.object({
  email: z.string().email(),
  age: z.number().min(0)
});

# 一起更新所有 ESLint 相关包
pnpm update eslint @typescript-eslint/parser @typescript-eslint/eslint-plugin

# 一起更新所有测试包
pnpm update vitest @vitest/ui @vitest/coverage-v8

# 一起更新所有 Next.js 包
pnpm update next react react-dom @types/react @types/react-dom

# 1. 类型检查
pnpm tsc --noEmit

# 2. 代码检查
pnpm lint

# 3. 单元测试
pnpm test

# 4. 构建验证
pnpm build

# 5. 开发服务器（冒烟测试）
pnpm dev
# 打开浏览器，测试关键功能

# 6. E2E 测试（如果可用）
pnpm test:e2e

对于主版本更新

# 1. 创建分支
git checkout -b chore/update-nextjs-15

# 2. 更新 package.json
# 将 "next": "^14.0.0" → "^15.0.0"

# 3. 安装
pnpm install

# 4. 阅读迁移指南
# 访问：nextjs.org/docs/upgrading

# 5. 处理破坏性变更
# 逐步遵循迁移指南

# 6. 彻底测试
pnpm test && pnpm build

# 7. 提交和 PR
git add .
git commit -m "chore: upgrade Next.js to v15"

步骤 1：识别未使用的依赖

未使用的依赖项
* lodash
* moment
* old-library

未使用的开发依赖项
* @types/old-package
* unused-test-lib

步骤 2：验证未使用

# 在代码库中搜索导入
rg "from 'lodash'" --type ts
rg "import.*lodash" --type ts
rg "require\('lodash'\)" --type js

# 如果没有结果 → 可以安全移除

步骤 3：移除包

pnpm remove lodash

步骤 4：更新锁文件

# npm
rm package-lock.json
npm install

# pnpm
rm pnpm-lock.yaml
pnpm install

# yarn
rm yarn.lock
yarn install

pnpm test
pnpm build

## 依赖清理

### 安全更新 (P0/P1)
- [ ] `next`: 14.0.4 → 14.2.3 (CVE-2024-XXXX)
- [ ] `jose`: 4.15.4 → 4.15.5 (CVE-2024-YYYY)

### 已移除（未使用）
- [ ] `lodash` - 已替换为原生 JS 方法
- [ ] `moment` - 已替换为 date-fns
- [ ] `@types/old-package` - 包不再使用

### 已更新（维护）
- [ ] `eslint`: 8.57.0 → 9.0.0
- [ ] `typescript`: 5.3.3 → 5.4.2

### 迁移说明
**lodash → 原生**:
- `_.get()` → 可选链 `obj?.prop?.value`
- `_.uniq()` → `[...new Set(array)]`

**moment → date-fns**:
- `moment().format('YYYY-MM-DD')` → `format(new Date(), 'yyyy-MM-dd')`

### 测试
- [ ] 所有测试通过 (`pnpm test`)
- [ ] 构建成功 (`pnpm build`)
- [ ] 开发环境中无运行时错误 (`pnpm dev`)
- [ ] E2E 测试通过（如果适用）

### 构建包大小影响
- 之前：2.4 MB
- 之后：1.8 MB
- **节省：600 KB（减少 25%）**

自动化安全检查

# .github/workflows/security.yml
name: 安全审计

on:
  schedule:
    - cron: '0 0 * * 1'  # 每周一
  pull_request:
  push:
    branches: [main]

jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: 设置 Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: 安装依赖项
        run: npm ci

      - name: 运行安全审计
        run: npm audit --audit-level=high

      - name: 检查过时包
        run: npm outdated || true

      - name: 依赖项审查
        uses: actions/dependency-review-action@v4
        if: github.event_name == 'pull_request'

# .github/workflows/snyk.yml
name: Snyk 安全

on: [push, pull_request]

jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: 运行 Snyk 检查漏洞
        uses: snyk/actions/node@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}

# npm 安全审计
npm audit

# 仅显示高/关键级别
npm audit --audit-level=high

# 获取 JSON 报告
npm audit --json > audit-report.json

# Snyk (需要：npm install -g snyk)
snyk test                    # 测试漏洞
snyk monitor                 # 持续监控
snyk wizard                  # 交互式修复

# Socket.dev (供应链安全)
npx socket-npm audit

通知：接收安全公告（GitHub、npm、Snyk）

评估影响：

# 查找易受攻击包的使用位置
npm ls vulnerable-package

# 检查是否使用了易受攻击的功能
rg "vulnerableFunction" --type ts

修补：

# 更新到已修补版本
npm install vulnerable-package@4.15.5

# 或更新依赖它的依赖项
npm update parent-package

验证修复：
```
npm audit
# 应显示 0 个漏洞
```

测试和部署：

pnpm test && pnpm build
git commit -m "fix: patch CVE-2024-XXXX in vulnerable-package"

## 依赖维护 - [YYYY-MM]

### 安全
- [ ] 运行 `npm audit` 并处理高/关键问题
- [ ] 审查 GitHub 安全公告
- [ ] 检查 Snyk 仪表板（如果已集成）

### 更新
- [ ] 检查 `npm outdated` 以获取主要更新
- [ ] 更新补丁版本：`npm update`
- [ ] 为已弃用包规划迁移

### 清理
- [ ] 运行 `npx depcheck` 查找未使用的依赖项
- [ ] 移除零导入的包
- [ ] 去重：`npm dedupe`

### 测试
- [ ] 运行完整测试套件
- [ ] 检查构建是否成功
- [ ] 验证开发服务器是否正常工作
- [ ] 在类生产环境中测试

### 文档
- [ ] 更新 CHANGELOG.md
- [ ] 记录破坏性变更
- [ ] 如果需要，更新 .env.example

自动化：设置 GitHub Actions 进行每周审计
批量更新：分组相关的依赖项更新
彻底测试：更新后切勿跳过测试
文档化：保持 CHANGELOG.md 更新
衡量影响：跟踪构建包大小变化
保持信息灵通：订阅安全公告
使用锁文件：提交 package-lock.json/pnpm-lock.yaml
渐进式迁移：不要一次性更新所有内容

2026 年 1 月 23 日

🇺🇸English

Dependency Audit Skill

Summary

Systematic workflow for auditing, updating, and cleaning up project dependencies. Covers security vulnerability scanning, outdated package detection, unused dependency removal, and migration from deprecated libraries.

When to Use

Weekly/monthly dependency maintenance
After security advisories (CVE announcements)
Before major releases
When bundle size increases unexpectedly
During code reviews for dependency changes
Onboarding to legacy projects

Quick Audit Process

1. Check Outdated Packages

# npm
npm outdated

# pnpm
pnpm outdated

# yarn
yarn outdated

# pip (Python)
pip list --outdated

# poetry (Python)
poetry show --outdated

2. Security Vulnerability Scan

# npm
npm audit
npm audit fix          # Auto-fix where possible
npm audit fix --force  # Force major version updates (risky)

# pnpm
pnpm audit
pnpm audit --fix

# yarn
yarn audit
yarn audit --fix

# Python
pip-audit              # Requires: pip install pip-audit
safety check           # Requires: pip install safety

3. Find Unused Dependencies

# JavaScript/TypeScript
npx depcheck

# Output example:
# Unused dependencies
# * lodash
# * moment
# Unused devDependencies
# * @types/old-package

# Python
pip-autoremove --list  # Requires: pip install pip-autoremove

Audit Commands

JavaScript/TypeScript/Node.js

npm

# Check what's outdated
npm outdated

# Update within semver range (safe)
npm update

# Update specific package to latest
npm install package@latest

# Check security vulnerabilities
npm audit

# Auto-fix vulnerabilities
npm audit fix

# View dependency tree
npm list
npm list --depth=0  # Top-level only

# Why is this package installed?
npm ls package-name

# Check for duplicate packages
npm dedupe

pnpm

# Check outdated
pnpm outdated

# Update all dependencies
pnpm update

# Update specific package
pnpm update package@latest

# Security audit
pnpm audit

# Deduplicate
pnpm dedupe

# List all packages
pnpm list

yarn

# Check outdated
yarn outdated

# Upgrade interactive (recommended)
yarn upgrade-interactive

# Update all
yarn upgrade

# Security audit
yarn audit

# Why is this here?
yarn why package-name

Python

pip

# List outdated
pip list --outdated

# Update specific package
pip install --upgrade package-name

# Security audit
pip-audit  # Install: pip install pip-audit

# Freeze current dependencies
pip freeze > requirements.txt

# Check dependencies of a package
pip show package-name

poetry

# Show outdated
poetry show --outdated

# Update all
poetry update

# Update specific package
poetry update package-name

# Security check
poetry audit  # poetry-audit-plugin required

# Show dependency tree
poetry show --tree

pipenv

# Check for security vulnerabilities
pipenv check

# Update all
pipenv update

# Update specific
pipenv update package-name

# Show dependency graph
pipenv graph

Priority Matrix

Priority	Type	Action	Timeline	Example
P0	Critical CVE (actively exploited)	Patch immediately	Same day	Auth bypass, RCE
P1	High CVE or major framework update	Plan migration	1-2 weeks	Next.js, React major version
P2	Deprecated with active usage	Find replacement	2-4 weeks	moment.js → date-fns
P3	Minor/patch updates	Batch update	Monthly	Non-breaking updates
P4	Unused dependencies	Remove

Priority Decision Tree

Is there a CVE?
├─ Yes → Is it critical/high severity?
│  ├─ Yes → P0 (patch immediately)
│  └─ No → P1 (plan update)
└─ No → Is package deprecated?
   ├─ Yes → Is it actively used?
   │  ├─ Yes → P2 (find replacement)
   │  └─ No → P4 (remove)
   └─ No → Is it outdated?
      ├─ Major version → P1 (plan migration)
      ├─ Minor/patch → P3 (batch update)
      └─ Unused → P4 (remove)

Common Replacements

Date/Time Libraries

JavaScript/TypeScript

// ❌ moment.js (deprecated, 288KB minified)
import moment from 'moment';
const formatted = moment().format('YYYY-MM-DD');
const diff = moment(date1).diff(moment(date2), 'days');

// ✅ date-fns (tree-shakeable, 2-5KB per function)
import { format, differenceInDays } from 'date-fns';
const formatted = format(new Date(), 'yyyy-MM-dd');
const diff = differenceInDays(date1, date2);

// ✅ Native Intl (zero bundle cost)
const formatted = new Intl.DateTimeFormat('en-US').format(new Date());
const relative = new Intl.RelativeTimeFormat('en').format(-1, 'day'); // "1 day ago"

Python

# ❌ arrow (overhead for simple tasks)
import arrow
now = arrow.now().format('YYYY-MM-DD')

# ✅ Native datetime
from datetime import datetime
now = datetime.now().strftime('%Y-%m-%d')

# ✅ pendulum (for complex timezone handling)
import pendulum
now = pendulum.now('America/New_York')

Utility Libraries

JavaScript/TypeScript

// ❌ Full lodash import (70KB)
import _ from 'lodash';
const value = _.get(obj, 'path.to.value');
const unique = _.uniq(array);

// ✅ Specific imports (5-10KB)
import get from 'lodash/get';
import uniq from 'lodash/uniq';

// ✅ Native alternatives (0KB)
const value = obj?.path?.to?.value;           // Optional chaining
const unique = [...new Set(array)];           // Set
const keys = Object.keys(obj);                // Object.keys
const flat = array.flat();                    // Array.flat()
const grouped = Object.groupBy(arr, fn);      // Object.groupBy

HTTP Clients

JavaScript/TypeScript

// ❌ axios (11KB) - often unnecessary
import axios from 'axios';
const { data } = await axios.get('/api/users');

// ✅ Native fetch (0KB) - built-in
const response = await fetch('/api/users');
const data = await response.json();

// ✅ ky (2KB) - if you need retries/timeout
import ky from 'ky';
const data = await ky.get('/api/users').json();

Python

# ❌ requests (large for serverless)
import requests
response = requests.get('https://api.example.com')

# ✅ httpx (async support, same API)
import httpx
async with httpx.AsyncClient() as client:
    response = await client.get('https://api.example.com')

# ✅ urllib (native, for simple cases)
from urllib.request import urlopen
response = urlopen('https://api.example.com')

Testing Libraries

JavaScript/TypeScript

// Consider consolidating test runners

// If using Jest + Vitest + Playwright separately:
// ✅ Vitest can replace Jest in most projects (faster, native ESM)
// ✅ Keep Playwright for E2E, use Vitest for unit/integration

Validation Libraries

JavaScript/TypeScript

// ❌ Multiple validation libraries
import * as yup from 'yup';
import Joi from 'joi';
import { z } from 'zod';

// ✅ Pick one (Zod recommended for TypeScript)
import { z } from 'zod';
const schema = z.object({
  email: z.string().email(),
  age: z.number().min(0)
});

Update Strategy

Batch Related Updates

# Update all ESLint-related packages together
pnpm update eslint @typescript-eslint/parser @typescript-eslint/eslint-plugin

# Update all testing packages together
pnpm update vitest @vitest/ui @vitest/coverage-v8

# Update all Next.js packages together
pnpm update next react react-dom @types/react @types/react-dom

Test After Updates

Comprehensive Testing Checklist

# 1. Type check
pnpm tsc --noEmit

# 2. Lint
pnpm lint

# 3. Unit tests
pnpm test

# 4. Build verification
pnpm build

# 5. Dev server (smoke test)
pnpm dev
# Open browser, test key features

# 6. E2E tests (if available)
pnpm test:e2e

Incremental Update Strategy

For Major Version Updates

# 1. Create branch
git checkout -b chore/update-nextjs-15

# 2. Update package.json
# Change "next": "^14.0.0" → "^15.0.0"

# 3. Install
pnpm install

# 4. Read migration guide
# Visit: nextjs.org/docs/upgrading

# 5. Address breaking changes
# Follow migration guide step-by-step

# 6. Test thoroughly
pnpm test && pnpm build

# 7. Commit and PR
git add .
git commit -m "chore: upgrade Next.js to v15"

Cleanup Workflow

Step 1: Identify Unused Dependencies

npx depcheck

Example Output:

Unused dependencies
* lodash
* moment
* old-library

Unused devDependencies
* @types/old-package
* unused-test-lib

Step 2: Verify Not Used

# Search codebase for imports
rg "from 'lodash'" --type ts
rg "import.*lodash" --type ts
rg "require\('lodash'\)" --type js

# If no results → safe to remove

Step 3: Remove Package

pnpm remove lodash

Step 4: Update Lock File

# npm
rm package-lock.json
npm install

# pnpm
rm pnpm-lock.yaml
pnpm install

# yarn
rm yarn.lock
yarn install

Step 5: Test

pnpm test
pnpm build

Cleanup PR Template

## Dependency Cleanup

### Security Updates (P0/P1)
- [ ] `next`: 14.0.4 → 14.2.3 (CVE-2024-XXXX)
- [ ] `jose`: 4.15.4 → 4.15.5 (CVE-2024-YYYY)

### Removed (Unused)
- [ ] `lodash` - replaced with native JS methods
- [ ] `moment` - replaced with date-fns
- [ ] `@types/old-package` - package no longer used

### Updated (Maintenance)
- [ ] `eslint`: 8.57.0 → 9.0.0
- [ ] `typescript`: 5.3.3 → 5.4.2

### Migration Notes
**lodash → Native**:
- `_.get()` → optional chaining `obj?.prop?.value`
- `_.uniq()` → `[...new Set(array)]`

**moment → date-fns**:
- `moment().format('YYYY-MM-DD')` → `format(new Date(), 'yyyy-MM-dd')`

### Testing
- [ ] All tests pass (`pnpm test`)
- [ ] Build succeeds (`pnpm build`)
- [ ] No runtime errors in dev (`pnpm dev`)
- [ ] E2E tests pass (if applicable)

### Bundle Size Impact
- Before: 2.4 MB
- After: 1.8 MB
- **Savings: 600 KB (25% reduction)**

Security Scanning

Automated Security Checks

GitHub Actions

# .github/workflows/security.yml
name: Security Audit

on:
  schedule:
    - cron: '0 0 * * 1'  # Weekly on Monday
  pull_request:
  push:
    branches: [main]

jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: Install dependencies
        run: npm ci

      - name: Run security audit
        run: npm audit --audit-level=high

      - name: Check for outdated packages
        run: npm outdated || true

      - name: Dependency review
        uses: actions/dependency-review-action@v4
        if: github.event_name == 'pull_request'

Snyk Integration

# .github/workflows/snyk.yml
name: Snyk Security

on: [push, pull_request]

jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Run Snyk to check for vulnerabilities
        uses: snyk/actions/node@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}

Manual Security Commands

# npm security audit
npm audit

# Show only high/critical
npm audit --audit-level=high

# Get JSON report
npm audit --json > audit-report.json

# Snyk (requires: npm install -g snyk)
snyk test                    # Test for vulnerabilities
snyk monitor                 # Continuous monitoring
snyk wizard                  # Interactive fixing

# Socket.dev (supply chain security)
npx socket-npm audit

CVE Response Process

Notification : Receive security advisory (GitHub, npm, Snyk)

Assess Impact :

# Find where vulnerable package is used
npm ls vulnerable-package

# Check if we use vulnerable functionality
rg "vulnerableFunction" --type ts

Patch :

# Update to patched version
npm install vulnerable-package@4.15.5

# Or update dependency that depends on it
npm update parent-package

Verify Fix :

npm audit
# Should show 0 vulnerabilities

Test & Deploy:

pnpm test && pnpm build
git commit -m "fix: patch CVE-2024-XXXX in vulnerable-package"

Summary

Monthly Maintenance Checklist

## Dependency Maintenance - [YYYY-MM]

### Security
- [ ] Run `npm audit` and address high/critical issues
- [ ] Review GitHub security advisories
- [ ] Check Snyk dashboard (if integrated)

### Updates
- [ ] Check `npm outdated` for major updates
- [ ] Update patch versions: `npm update`
- [ ] Plan migration for deprecated packages

### Cleanup
- [ ] Run `npx depcheck` to find unused deps
- [ ] Remove packages with zero imports
- [ ] Deduplicate: `npm dedupe`

### Testing
- [ ] Run full test suite
- [ ] Check build succeeds
- [ ] Verify dev server works
- [ ] Test in production-like environment

### Documentation
- [ ] Update CHANGELOG.md
- [ ] Document breaking changes
- [ ] Update .env.example if needed

Best Practices

Automate : Set up GitHub Actions for weekly audits
Batch Updates : Group related dependency updates
Test Thoroughly : Never skip tests after updates
Document : Keep CHANGELOG.md updated
Measure Impact : Track bundle size changes
Stay Informed : Subscribe to security advisories
Use Lock Files : Commit package-lock.json/pnpm-lock.yaml
Gradual Migration : Don't update everything at once

Weekly Installs

107

Repository

bobmatnyc/claud…m-skills

GitHub Stars

First Seen

Jan 23, 2026

Security Audits

Gen Agent Trust HubPass SocketPass SnykPass

Installed on

codex87

gemini-cli85

opencode83

claude-code81

github-copilot80

cursor79

Azure RBAC 权限管理工具：查找最小角色、创建自定义角色与自动化分配

127,200 周安装

依赖审计完整指南：安全漏洞扫描、过时包检测与清理工作流

🇨🇳中文介绍

依赖审计技能

概述

使用时机

快速审计流程

1. 检查过时包

2. 安全漏洞扫描

3. 查找未使用的依赖

相关 Skills

审计命令

JavaScript/TypeScript/Node.js

npm

pnpm

yarn

Python

pip

poetry

pipenv

优先级矩阵

优先级决策树

常见替代方案

日期/时间库

JavaScript/TypeScript

Python

工具库

JavaScript/TypeScript

HTTP 客户端

JavaScript/TypeScript

Python

测试库

JavaScript/TypeScript

验证库

JavaScript/TypeScript

更新策略

批量相关更新

更新后测试

综合测试清单

增量更新策略

对于主版本更新

清理工作流程

步骤 1：识别未使用的依赖

步骤 2：验证未使用

步骤 3：移除包

步骤 4：更新锁文件

步骤 5：测试

清理 PR 模板

安全扫描

自动化安全检查

GitHub Actions

Snyk 集成

手动安全命令

CVE 响应流程

总结

月度维护清单

最佳实践

🇺🇸English

Dependency Audit Skill

Summary

When to Use

Quick Audit Process

1. Check Outdated Packages

2. Security Vulnerability Scan

3. Find Unused Dependencies

Audit Commands

JavaScript/TypeScript/Node.js

npm

pnpm

yarn

Python

pip

poetry

pipenv

Priority Matrix

Priority Decision Tree

Common Replacements

Date/Time Libraries

JavaScript/TypeScript

Python

Utility Libraries