---
slug: "pi-dep-audit"
source_type: "readme"
source_url: "https://cdn.jsdelivr.net/gh/ZachDreamZ/pi-dep-audit@main/README.md"
repo: "https://github.com/ZachDreamZ/pi-dep-audit"
source_file: "README.md"
branch: "main"
---
# pi-dep-audit

Audit npm dependencies for vulnerabilities, outdated packages, and license compliance — integrated into your pi.dev workflow.

## Features

- **CVE Scanning** — queries [OSV.dev](https://osv.dev) for known vulnerabilities (no API key needed)
- **Outdated Detection** — semver-aware severity classification (major/minor/patch)
- **License Compliance** — detects copyleft licenses in permissive projects
- **Auto-Fix** — bump vulnerable packages to safe versions automatically
- **Structured Output** — JSON report for CI integration + human-readable summary

## Install

```bash
npx pi install pi-dep-audit
```

Or add to your pi project:

```bash
npm install pi-dep-audit
```

## Usage

### Slash Command

Type `/audit` in your pi.dev agent to run a full dependency audit:

```
> /audit

╔══════════════════════════════════════════════════════════════╗
║  📦 DEPENDENCY AUDIT REPORT
║  Project: my-awesome-app
║  2026-06-25T12:00:00.000Z
╚══════════════════════════════════════════════════════════════╝

🔒 VULNERABILITIES
────────────────────────────────────────
  ✅ No known vulnerabilities found

📊 OUTDATED PACKAGES
────────────────────────────────────────
  Total: 2 (1 major, 1 minor, 0 patch)

  🔴 lodash: 4.17.20 → 4.17.21 (patch)
  🟡 express: 4.18.0 → 4.18.2 (patch)

📜 LICENSES
────────────────────────────────────────
  Total packages: 42
  MIT: 38
  ISC: 3
  BSD-2-Clause: 1
```

### Tools

The extension registers two tools for the LLM:

#### `dep-audit`

Run a full dependency audit:

```typescript
// The LLM calls this when you ask about dependency health
"Check my dependencies for vulnerabilities"
```

#### `dep-fix`

Auto-fix vulnerabilities:

```typescript
// The LLM calls this when you ask to fix issues
"Fix all dependency vulnerabilities"
```

Supports a `dry_run` parameter to preview changes without applying them.

## How It Works

### Vulnerability Detection

Uses the [OSV.dev API](https://osv.dev/docs/) — a free, open-source vulnerability database. Queries are made per-package-version, matching against the npm ecosystem.

### Outdated Detection

Runs `npm outdated --json` and classifies version bumps:

- **Major** (🔴) — breaking changes likely
- **Minor** (🟡) — new features, backward compatible
- **Patch** (🟢) — bug fixes only

### License Compliance

Scans `node_modules/*/package.json` for license fields and flags:

- Copyleft licenses (GPL, AGPL, LGPL) in permissive projects (MIT, BSD, ISC)
- Unknown or unparseable licenses

### Auto-Fix Strategy

1. **Security updates first** — bump packages with known CVEs to their fix version
2. **Version updates second** — apply non-breaking updates (wanted version)
3. Reports successes and failures separately

## Requirements

- Node.js 18+
- npm project with `package.json`
- `node_modules` installed (for license scanning)

## License

MIT