dependency-audit

Dependency risk assessment, read-only: known CVEs, deprecated packages, licence compliance, maintenance status, lockfile integrity, and a justification for every new dependency. Acting on it is dependency-upgrade.