dep-audit

Files (1)

• SKILL.md

SKILL.md (first lines)

# Dependency security audit

What is not obvious is that these subcommands exist at all; running them shows
what they print.

## The commands

| | Audit | Full tree | Why is X here |
|---|---|---|---|
| Python | `uv audit` | `uv tree` | `uv tree --package X --invert` |
| JS/TS | `bun audit` | `bun pm ls --all` | `bun pm why X` |

`uv audit` checks OSV; `bun audit` checks the npm advisory database. Both take
`--ignore <ID>` for an accepted risk. In CI, `uv audit --frozen` and
`bun audit --audit-level moderate` exit non-zero on a finding.

## The two calls that matter

**Reachability before upgrade.** A published advisory against an installed
package is not automatically a vulnerability in this project — the affected code
path may never be entered. Check who pulls it in (`uv tree --package X
--invert`) and whether the vulnerable call is reached, before bumping a version
that may break something real. The default reflex is to upgrade on sight; that
reflex is what this line exists to interrupt.

**Report the delta, never the tree.** A summary names what changed and
summarises a long transitive tail by count, rather than pasting `uv tree` or
`bun pm ls` output. Recording dependency changes in a session log has its own format:
`/dev-conventions:doc-conventions`.

## What here is perishable

The command surface is a claim about someone else's tool, so it moves on their
release schedule rather than this repo's. Verified 2026-08-17 against uv 0.11.32
and bun 1.3.14: every subcommand and flag above exists and behaves as described.
Re-check that line first; the two judgment calls above do not decay.

From fblissjr/fb-claude-skills, Apache-2.0.

More from fblissjr/fb-claude-skills