Dependency Management
Audits every manifest in a polyglot repository for vulnerabilities, licence conflicts and stale versions.
Install
Claude Code: /plugin marketplace add wshobson/agents → /plugin install dependency-management
Bağımlılıklar denetlenirken, güvenlik açığı taranırken ya da lisans uyumu ve sürüm yükseltmesi gözden geçirilirken devreye giriyor.
- Author
- Seth Hobson
- License
- MIT
The audit begins by discovering manifests rather than assuming a single ecosystem: package and lock files for npm, requirements, Pipfile, pyproject and poetry lock for Python, Gemfile for Ruby, Maven and Gradle for Java, go.mod and go.sum, Cargo for Rust. It then separates three things that usually get collapsed into one number — known vulnerabilities with a stated fix path, licence obligations that conflict with how the project ships, and packages stale enough to be a maintenance risk even without a published CVE. Lock files are read alongside manifests, which is where transitive dependencies actually live and where a clean top-level report can hide the real exposure. A bundled modernizer agent carries out the upgrade, including the breaking changes an audit only points at.
Comments(0)
Sign in to comment