{
  "id": "ccgm/dependencies",
  "name": "Dependencies Audit",
  "version": "1.1.0",
  "applies_when": ["language:javascript"],
  "tags": ["dependencies", "npm", "pip", "cargo", "bundler", "vulnerabilities", "supply-chain"],
  "severity_floor": "low",
  "tools": ["dep-audit", "knip", "pip-audit", "cargo-audit", "bundler-audit"],
  "checks": [
    {
      "id": "dependencies/npm-audit-vulnerability",
      "severity": "high",
      "confidence": "high",
      "detection": "tool",
      "tool": "dep-audit",
      "auto_fixable": true
    },
    {
      "id": "dependencies/outdated-minor",
      "severity": "low",
      "confidence": "high",
      "detection": "llm",
      "auto_fixable": true
    },
    {
      "id": "dependencies/outdated-major",
      "severity": "medium",
      "confidence": "high",
      "detection": "llm",
      "auto_fixable": false
    },
    {
      "id": "dependencies/unused-dependency",
      "severity": "low",
      "confidence": "medium",
      "detection": "hybrid",
      "tool": "knip",
      "fallback": "llm",
      "auto_fixable": true
    },
    {
      "id": "dependencies/duplicate-dependency",
      "severity": "medium",
      "confidence": "high",
      "detection": "llm",
      "auto_fixable": false
    },
    {
      "id": "dependencies/postinstall-script",
      "severity": "high",
      "confidence": "medium",
      "detection": "llm",
      "auto_fixable": false
    },
    {
      "id": "dependencies/typosquat",
      "severity": "high",
      "confidence": "low",
      "detection": "llm",
      "auto_fixable": false
    },
    {
      "id": "dependencies/lockfile-integrity",
      "severity": "high",
      "confidence": "medium",
      "detection": "llm",
      "auto_fixable": false
    },
    {
      "id": "dependencies/unpinned-version-range",
      "severity": "medium",
      "confidence": "high",
      "detection": "llm",
      "auto_fixable": false
    }
  ]
}