V1015 Dependency audit · Awesome Reviewers

Sub-techniques

3

ID	Name	Description
`V1015.001`	Advisory matching	Compare resolved versions with OSV, GitHub and ecosystem advisories.
`V1015.002`	Reachability-aware audit	Report a vulnerable dependency only when the vulnerable function is called.
`V1015.003`	License policy	Allow or deny dependencies by license.

Craft it

Run an audit on every manifest or lockfile change and on a daily schedule.
Fail on high severity with a fix available; warn on the rest.
Use a reachability-aware tool where the ecosystem has one.

Reverse engineer it

Signs that a codebase already runs this technique, and where to read how it is configured.

deny.toml, osv-scanner.toml, a dependency-review workflow or an audit script.
Dependabot or Renovate config with security updates enabled.

Where the scanned repositories configure it:

.github/workflows/*.yml in 35 repositories
deny.toml in 14 repositories
package.json in 5 repositories
.pre-commit-config.yaml in 1 repositories
Makefile in 1 repositories
pyproject.toml in 1 repositories

Detected by the scanner as: Dependency audit (known-vulnerable or disallowed dependencies and licenses.)

Open-source packages

5

OSV-Scanner google/osv-scanner
pip-audit pypa/pip-audit
govulncheck golang/vuln
cargo-deny EmbarkStudios/cargo-deny
Grype anchore/grype

Tools seen in scans

by repositories that run them

Tool	Repos	Command seen	Runs in	Docs
`cargo-deny`	19	`cargo deny --all-features check sources`	ci, local	docs
`dependency-review`	12	via GitHub Action actions/dependency-review-action	ci	docs
`npm-audit`	9	`npm audit --audit-level=high`	ci, local	docs
`govulncheck`	4	`govulncheck ./...`	ci	docs
`cargo-audit`	2	`cargo audit`	ci	docs
`pip-audit`	2	`pip-audit ${pip_audit_args[@]}`	pre-commit, ci	docs

Procedure examples

repositories that run it, most-starred first

Repository	Tools	Runs in	Evidence
nousresearch/hermes-agent	`npm-audit`	local	`package.json scripts.audit:root`
axios/axios	`dependency-review`	ci	`.github/workflows/run-ci.yml jobs.build-and-run-vitest.steps[9] (Dependency R...`
mermaid-js/mermaid	`dependency-review`	ci	`.github/workflows/dependency-review.yml jobs.dependency-review.steps[1] (Depe...`
home-assistant/core	`dependency-review`	ci	`.github/workflows/ci.yaml jobs.dependency-review.steps[1] (Dependency review)`
earendil-works/pi	`npm-audit`	ci	`.github/workflows/npm-audit.yml jobs.audit.steps[4] (Verify registry signatures)`
zed-industries/zed	`dependency-review`	ci	`.github/workflows/run_tests.yml jobs.check_dependencies.steps[7] (run_tests::...`
astral-sh/uv	`cargo-deny`	ci	`.github/workflows/check-lint.yml jobs.cargo-deny.steps[2] (Check licenses)`
prometheus/prometheus	`govulncheck`	ci	`.github/workflows/govulncheck.yml jobs.govulncheck.steps[1]`
mvanhorn/last30days-skill	`dependency-review`	ci	`.github/workflows/security.yml jobs.dependency-review.steps[1] (Review depend...`
warpdotdev/warp	`cargo-deny`	ci	`.github/workflows/ci.yml jobs.general-lint.steps[3] (Check licenses for depen...`
aaif-goose/goose	`cargo-deny`	ci	`.github/workflows/cargo-deny.yml jobs.deny.steps[1]`
prettier/prettier	`dependency-review`	ci	`.github/workflows/lint.yml jobs.lint.steps[12] (Dependency Review)`
ruvnet/ruflo	`dependency-review`, `npm-audit`	ci, local	`.github/workflows/v3-ci.yml jobs.dependency-review.steps[1] (Dependency Review)`
apache/airflow	`dependency-review`, `govulncheck`	ci	`.github/workflows/dependency-review.yml jobs.dependency-review.steps[0] (Revi...`
astral-sh/ruff	`cargo-deny`	ci	`.github/workflows/ci.yaml jobs.cargo-deny.steps[2] (Check licenses)`
novuhq/novu	`dependency-review`	ci	`.github/workflows/on-pr.yml jobs.dependency-review.steps[1] (Dependency Review)`
gofiber/fiber	`govulncheck`	ci	`.github/workflows/vulncheck.yml jobs.govulncheck-check.steps[3] (Run Govulnch...`
can1357/oh-my-pi	`cargo-deny`	ci	`.github/workflows/ci.yml jobs.check.steps[2] (Verify Rust license compliance ...`
pola-rs/polars	`cargo-deny`	ci, local	`.github/workflows/lint-rust.yml jobs.deny.steps[2] (Run cargo deny)`
crewaiinc/crewai	`pip-audit`	pre-commit, ci	`.github/workflows/vulnerability-scan.yml jobs.pip-audit.steps[5] (Run pip-audit)`
diegosouzapw/OmniRoute	`npm-audit`	ci, local	`.github/workflows/ci.yml jobs.lint.steps[4]`
openai/codex	`cargo-deny`	ci	`.github/workflows/cargo-deny.yml jobs.cargo-deny.steps[3] (Run cargo-deny)`
tokio-rs/tokio	`cargo-deny`	ci	`.github/workflows/audit.yml jobs.cargo-deny.steps[1]`
promptfoo/promptfoo	`npm-audit`	local	`package.json scripts.audit:fix`
opentofu/opentofu	`govulncheck`	ci	`.github/workflows/govulncheck.yml jobs.govulncheck.steps[3] (Run and report g...`
tokio-rs/axum	`cargo-deny`	ci	`.github/workflows/CI.yml jobs.deny-check.steps[1]`
Hmbown/DeepSeek-TUI	`cargo-audit`, `cargo-deny`, `npm-audit`	ci	`.github/workflows/security-audit.yml jobs.self-audit.steps[3] (Run cargo audit)`
jj-vcs/jj	`cargo-deny`	ci	`.github/workflows/ci.yml jobs.check-cargo-deny.steps[1]`
block/goose	`cargo-deny`	ci	`.github/workflows/cargo-deny.yml jobs.deny.steps[1]`
neondatabase/neon	`cargo-deny`	ci	`.github/workflows/cargo-deny.yml jobs.cargo-deny.steps[2] (Check rust license...`
adonisjs/core	`npm-audit`	ci	`.github/workflows/release.yml jobs.release.steps[4]`
langfuse/langfuse	`cargo-deny`	ci, local	`.github/workflows/licencecheck.yml jobs.rust_license_check.steps[3] (Check ai...`
huggingface/tokenizers	`cargo-audit`	ci	`.github/workflows/node.yml jobs.audit.steps[4] (Run Audit)`
awslabs/mcp	`dependency-review`	ci	`.github/workflows/dependency-review-action.yml jobs.dependency-review.steps[1...`
openai/codex-security	`npm-audit`	ci	`.github/workflows/action-ci.yml jobs.dependencies.steps[2] (Check action depe...`
maximhq/bifrost	`dependency-review`	ci	`.github/workflows/dependency-review.yml jobs.dependency-review.steps[2] (Depe...`
strands-agents/sdk-python	`dependency-review`, `npm-audit`, `pip-audit`	ci	`.github/workflows/ci.yml jobs.dependency-review.steps[1]`

Dependency audit