dependency-review

Audits AUR PKGBUILD updates before you install: detects structural changes, suspicious commands, typosquatting, and novelty signals, then produces a deterministic evidence report.

A dependency-decision ledger for Node.js & coding agents — every dependency recorded, explained, and reviewable in the PR. Zero runtime deps.

Hands-on study guide for the GH-500: GitHub Advanced Security certification. Covers all 5 exam domains with docs, demos, CodeQL, Dependabot config, and automation scripts.

Understand npm lockfile changes. Offline dependency review with before/after trails, CLI and portable HTML reports.

Review dependency update PRs by blast radius: package-lock changes, semver jumps, bin entries, install scripts, and CI risk gates.

See what you're merging. Sightglass compares a package release with the previous one and with its git tag, and shows the evidence: dropped attestations, files not in the source, new code that runs on import.

SBOM diff gate: compares CycloneDX 1.4-1.6 / SPDX 2.3 SBOMs or git refs, reports added, removed, upgraded and downgraded components plus license, supplier and hash changes, checks OSV.dev for new vs fixed vulns, and enforces policy. Text/JSON/SARIF/Markdown, GitHub Action.

GitHub Actions GH-500 Certification Study Guide: Complete and up-to-date guide for the GitHub Advanced Security (GHAS) Certification GH-500 Exam. Includes all domains, key concepts, configuration of Secret Scanning, Dependabot, CodeQL, and best practices.

Offline semantic dependency review across npm, pnpm, Yarn, uv, Poetry, Cargo, and Go.

GitHub Action for reviewing dependency changes and policy findings in pull requests with Bomly CLI.

Review Dart and Flutter dependency updates for new build hooks, native files, and plugin platform declarations.

Read-only GitHub Action for pull request risk review: secret patterns, workflow hazards, sensitive files, and dependency lock changes. Dependency-free, privacy-first, with a JSON and Actions summary report.

See the chain reaction in your npm lockfile. A local-first dependency change map with before/after paths and PR-ready reviews.

Community health files and a reusable GitHub Actions security workflow (CodeQL, gitleaks, dependency review, OpenSSF Scorecard) for every basitalisandhu repository: security policy with 90-day coordinated disclosure, contributing guide, code of conduct, issue and PR templates.

🤖 Globomantics Robot Fleet Manager - Educational demo with vulnerable dependencies for GitHub Advanced Security training. Tim Warner's Pluralsight Dependency Review course. Learn more: https://pluralsight.com

A Pi.dev skill focused on risk assessment before modifying dependencies in Node.js projects. It helps the agent analyze package-related changes before installing, updating, migrating, or modifying dependencies

Diff npm package trust surfaces before you approve an update.

Review what a pinned GitHub Action SHA bump actually changes before you approve it.

Exact npm/PyPI dependency PR reviews with cited migration steps. One wallet-free GitHub OIDC trial; optional bounded x402 payment.

GitHub CLI extension for on-demand PR dependency risk review with Dependency Review API first and static local fallback