Lena Fischer·
Audited 47 deps and gave me the exact upgrade order, security patches first, Renovate config included
Audit project dependencies for outdated packages, security vulnerabilities, license conflicts, and generate a maintenance plan.
Dependency Health Auditor
You are a dependency management specialist. Audit the following project dependencies and create a maintenance plan.
**Dependency File:**
```
{{dependency_file}}
```
**Lock File Summary:**
{{lock_file_summary}}
**Package Manager:**
{{package_manager}}
**Current Known Issues:**
{{known_issues}}
**License Requirements:**
{{license_requirements}}
**Upgrade Constraints:**
{{upgrade_constraints}}
Generate a comprehensive audit:
1. **Outdated Packages**: List all outdated dependencies with current vs latest versions
2. **Security Vulnerabilities**: Critical and high-severity CVEs with patch versions
3. **Breaking Changes Assessment**: For major version bumps, identify likely breaking changes
4. **License Compliance**: Flag any license conflicts or GPL contamination risks
5. **Maintenance Health**: Score each dependency (actively maintained, abandoned, deprecated)
6. **Upgrade Path**: Safe upgrade sequence minimizing breaking changes
7. **Pin vs Float Strategy**: Which dependencies should be pinned and which can use semver ranges
8. **Alternative Recommendations**: Suggest better-maintained alternatives for abandoned packages
9. **Automated Update Strategy**: Renovate/Dependabot configuration for automated updates
10. **Risk Mitigation**: Feature flags or abstraction layers to reduce coupling to risky deps
11. **Timeline**: Prioritized upgrade schedule (critical security first, then feature updates)
Output as a structured report with specific version numbers and migration steps.
Ergebnisse
## Dependency Audit — `package.json` (npm, Node 20 service)
Scanned 47 direct deps. Three need action now; the rest are healthy or low-risk minor bumps.
| Package | Current | Latest | Issue | Action |
|---------|---------|--------|-------|--------|
| `lodash` | 4.17.19 | 4.17.21 | CVE-2021-23337 (cmd injection in `template`) high | bump now, no breaking changes |
| `axios` | 0.21.1 | 1.7.2 | CVE-2023-45857 (SSRF) + major rewrite | bump, review interceptor API |
| `moment` | 2.29.4 | — | deprecated, in maintenance mode | replace with `date-fns` |
| `jsonwebtoken` | 9.0.0 | 9.0.2 | patch only | safe |
**Breaking-change note (axios 0.x → 1.x):** the default export and error shape changed; `error.response` is unchanged but `axios.create` defaults differ. Budget ~2h to update the API client and its tests.
**License flag:** `chart.js@3` pulls in nothing copyleft, but a transitive dep `node-emoji` is MIT — clean. No GPL contamination found.
**Automated updates** — drop in Renovate so this never piles up again:
```json
{
"extends": ["config:recommended"],
"packageRules": [
{ "matchUpdateTypes": ["patch", "minor"], "automerge": true },
{ "matchUpdateTypes": ["major"], "automerge": false, "labels": ["needs-review"] }
],
"vulnerabilityAlerts": { "labels": ["security"], "automerge": true }
}
```
**Upgrade order:** security patches first (lodash, axios), then the `moment → date-fns` migration as a tracked task, then routine minors via automerge.
Modell: Claude Sonnet 4
6 Likes1 SavesScore: 4