methods / supply-chain

Supply chain

Checks dependencies: known vulnerabilities, disallowed licenses, lockfiles that disagree with manifests.

When: When a manifest or lockfile changes, and on a schedule, since advisories arrive after the code ships.

21% of scanned repositories run at least one

7 tools detected

Dependency audit

called for by: authentication, input handling, secrets, permissions; dependencies and lockfiles

Catches: Known-vulnerable or disallowed dependencies and licenses.

Tool	Languages	Repos	Command seen	Docs
`cargo-deny`	rust	19	`cargo deny --all-features check bans`	docs
`dependency-review`	any	12	`uses actions/dependency-review-action`	docs
`npm-audit`	javascript, typescript	9	`npm audit --audit-level=high`	docs
`govulncheck`	go	4	`govulncheck ./...`	docs
`cargo-audit`	rust	2	`cargo audit`	docs
`pip-audit`	python	2	`pip-audit ${pip_audit_args[@]}`	docs

called for by: dependencies and lockfiles

Catches: A lockfile that no longer matches its manifest.

Tool	Languages	Repos	Command seen	Fix	Docs
`uv-lock`	python	16	`uv lock --check`	autofix	docs