dependency-scanner

name	dependency-scanner
description	Use when automated dependency auditing for npm, pip, cargo, go. Detect vulnerabilities, outdated packages, license conflicts, and supply chain risks. Generate SBOMs and compliance reports.
domain	development
author	oyi77
license	Apache-2.0
subdomain	software-development
tags	["security","dependencies","vulnerabilities","supply-chain","sbom","compliance"]
version	1.0.0

Dependency Scanner

When to Use

Trigger phrases:

• "Scan dependencies for vulnerabilities"
• "Check for outdated packages"
• "Audit project dependencies"
• "Generate SBOM"
• "License compliance check"
• "Supply chain security audit"

Use cases:

• Pre-release security checks
• CI/CD pipeline integration
• Compliance auditing (SOC2, GDPR, HIPAA)
• Open source license management
• Dependency update planning

When NOT to use:

• When using vendored dependencies with known state
• For runtime-only security (use SAST/DAST instead)

When NOT to Use

• For throwaway prototypes (skip the ceremony)
• When the fix is a single-line change with no side effects
• When the codebase already has a working solution

Overview

Dependency Scanner supports coding practices with best practices and proven patterns.

Workflow

# Example: TDD workflow
def test_user_creation():
    user = create_user(name="Alice", email="[e-mail]")
    assert user.name == "Alice"
    assert user.email == "[e-mail]"
    assert user.created_at is not None

def test_user_creation_invalid_email():
    with pytest.raises(ValidationError):
        create_user(name="Alice", email="invalid")

1. Understand requirements — Clarify acceptance criteria and constraints
2. Design solution — Plan architecture and identify patterns
3. Implement — Write code following project conventions
4. Test — Unit tests, integration tests, edge cases
5. Review — Code review for quality, security, and performance
6. Document — Update relevant docs and changelogs

Quality Gates

• All tests passing
• No lint errors or warnings
• Code coverage meets threshold (≥70%)
• No security vulnerabilities detected
• Documentation updated

Best Practices

• Follow SOLID principles and KISS
• Write self-documenting code with clear naming
• Handle errors explicitly — no silent failures
• Keep functions small and focused (<50 lines)
• Use immutable data patterns where possible

Anti-Rationalization Table

Rationalization	Reality
"Tests slow me down"	Bugs slow you down 10x more. Tests are speed, not overhead.
"I will refactor later"	Technical debt compounds. Refactor as you go.
"It works on my machine"	If it is not in CI, it does not work. Ship proof, not claims.

Process

1. Prepare — Gather requirements, verify prerequisites, set up environment
2. Execute — Run dependency scanner workflow with configured parameters
3. Verify — Validate output meets requirements, document results

Verification

• All steps executed successfully
• Results validated against acceptance criteria
• Error handling tested with edge cases
• Documentation updated with findings