Checks · DEP-001

DEP-001 · Dependency with known critical CVE

Why it matters

A critical vulnerability in a package you actually import can be used against the running app.

How we detect it

The lockfile is checked against the OSV database, then filtered by whether the package is imported.

How we fix it

Bump the package to a fixed version.

Can it be fixed automatically? Yes, with a template change

Related checks

• DB-006 · No backups or point-in-time recovery
• DB-007 · Backups never restore-tested
• TLS-001 · Certificate expires in under 14 days
• TLS-002 · TLS below 1.2 accepted