dependency-review

Audits AUR PKGBUILD updates before you install: detects structural changes, suspicious commands, typosquatting, and novelty signals, then produces a deterministic evidence report.

A dependency-decision ledger for Node.js & coding agents — every dependency recorded, explained, and reviewable in the PR. Zero runtime deps.

Hands-on study guide for the GH-500: GitHub Advanced Security certification. Covers all 5 exam domains with docs, demos, CodeQL, Dependabot config, and automation scripts.

Understand npm lockfile changes. Offline dependency review with before/after trails, CLI and portable HTML reports.

Review dependency update PRs by blast radius: package-lock changes, semver jumps, bin entries, install scripts, and CI risk gates.

GitHub Actions GH-500 Certification Study Guide: Complete and up-to-date guide for the GitHub Advanced Security (GHAS) Certification GH-500 Exam. Includes all domains, key concepts, configuration of Secret Scanning, Dependabot, CodeQL, and best practices.

SBOM diff gate: compares CycloneDX 1.4-1.6 / SPDX 2.3 SBOMs or git refs, reports added, removed, upgraded and downgraded components plus license, supplier and hash changes, checks OSV.dev for new vs fixed vulns, and enforces policy. Text/JSON/SARIF/Markdown, GitHub Action.

See what you're merging. Sightglass compares a package release with the previous one and with its git tag, and shows the evidence: dropped attestations, files not in the source, new code that runs on import.

Offline semantic dependency review across npm, pnpm, Yarn, uv, Poetry, Cargo, and Go.

Community health files and a reusable GitHub Actions security workflow (CodeQL, gitleaks, dependency review, OpenSSF Scorecard) for every basitalisandhu repository: security policy with 90-day coordinated disclosure, contributing guide, code of conduct, issue and PR templates.

GitHub Action for reviewing dependency changes and policy findings in pull requests with Bomly CLI.

See the chain reaction in your npm lockfile. A local-first dependency change map with before/after paths and PR-ready reviews.

Review Dart and Flutter dependency updates for new build hooks, native files, and plugin platform declarations.

Offline npm lockfile diff gate for PRs: flags new install scripts, changed integrity hashes, git/tarball sources and other supply-chain red flags in package-lock.json. Zero deps, SARIF, GitHub Action.

Read-only GitHub Action for pull request risk review: secret patterns, workflow hazards, sensitive files, and dependency lock changes. Dependency-free, privacy-first, with a JSON and Actions summary report.

Review what a pinned GitHub Action SHA bump actually changes before you approve it.

Exact npm/PyPI dependency PR reviews with cited migration steps. One wallet-free GitHub OIDC trial; optional bounded x402 payment.

Diff npm package trust surfaces before you approve an update.

🤖 Globomantics Robot Fleet Manager - Educational demo with vulnerable dependencies for GitHub Advanced Security training. Tim Warner's Pluralsight Dependency Review course. Learn more: https://pluralsight.com

A Pi.dev skill focused on risk assessment before modifying dependencies in Node.js projects. It helps the agent analyze package-related changes before installing, updating, migrating, or modifying dependencies