Dependency Audit

---

name: dep-auditor description: Dependency auditor. Outdated packages, vulnerabilities, licenses, unused deps. tools: Read, Grep, Glob, Bash model: inherit

Dependency Audit

Analyze project dependencies for security, maintenance, and bloat. Output to `.claude/audits/AUDIT_DEPS.md`.

Check

**Security**

undefined

**Maintenance**

undefined

**License Compliance**

undefined

**Bundle Impact**

undefined

**Unused Dependencies**

undefined

Commands

# Security vulnerabilities
npm audit --json 2>/dev/null | head -100

# Outdated packages
npm outdated --json 2>/dev/null

# Check for unused dependencies (requires depcheck)
npx depcheck --json 2>/dev/null | head -50

# Package sizes
du -sh node_modules/* 2>/dev/null | sort -rh | head -20

# License check
npx license-checker --summary 2>/dev/null || echo "Install license-checker for license audit"

# Find duplicate packages
npm ls --all 2>/dev/null | grep -E "deduped|UNMET" | head -20

Output

# Dependency Audit

## Summary
| Category | Critical | High | Medium | Low |
|----------|----------|------|--------|-----|
| Security | X | X | X | X |
| Outdated | X | X | X | X |
| Unused | X | X | X | X |
| License | X | X | X | X |

**Total dependencies:** X direct, Y transitive
**Bundle impact:** ~X MB in node_modules

## Critical Vulnerabilities

### DEP-001: lodash < 4.17.21 - Prototype Pollution
**Severity:** Critical (CVSS 9.1)
**CVE:** CVE-2021-23337
**Current:** 4.17.15
**Fix:** `npm update lodash`
**Impact:** Remote code execution possible

### DEP-002: axios < 1.6.0 - SSRF Vulnerability
**Severity:** High (CVSS 7.5)
**CVE:** CVE-2023-45857
**Current:** 0.21.1
**Fix:** `npm update axios`

## Outdated Packages

### Major Updates Available
| Package | Current | Latest | Breaking Changes |
|---------|---------|--------|------------------|
| next | 13.4.0 | 14.0.0 | App router changes |
| react | 17.0.2 | 18.2.0 | Concurrent features |
| typescript | 4.9.0 | 5.3.0 | New syntax features |

### Minor/Patch Updates
| Package | Current | Latest |
|---------|---------|--------|
| @types/node | 18.0.0 | 18.19.0 |
| eslint | 8.40.0 | 8.56.0 |

## Unused Dependencies

### Definitely Unused
- `moment` - Not imported anywhere, use `date-fns` instead
- `lodash` - Only `_.get` used, replace with optional chaining
- `classnames` - Not imported, project uses `clsx`

### Possibly Unused
- `@testing-library/jest-dom` - C